Spyware / Malware / Virus Removal
A Little Help Please. Computer Doesnt Compute!
33 min read
← Previous
Page 2 of 3
Next →
This thread's last reply is from December 2, 2006, 2:15 AM UTC . Advice, software, and links
below may be out of date — treat specific steps and download links with caution.
Looking for the outcome? ✨ Ask AI
I'd say lets see if we can clean it.
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)
It's normal after running ATF cleaner that the PC will be slower to boot the first time.
Next:
Download
AVG Anti-Spyware from
HERE and save that file to your
desktop.
This is a 30 day trial of the program Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop
and double-click it to launch the set up program. Once the setup is complete you will need run ewido and update the definition
files. On the main screen select the icon "Update " then select the "
Update now " link.Next select the "Start Update " button, the update will start and a
progress bar will show the updates being installed. Once the update has completed select the "Scanner " icon at the top of
the screen, then select the "Settings " tab. Once in the Settings screen click on "Recommended actions " and then
select ""Quarantine". ". Under "Reports "Select "Automatically generate report after every scan " Un-Select "Only if threats were found " Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly .
Reboot your computer into SafeMode . You can do this by restarting
your computer and continually tapping the F8 key until a menu appears.
Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess: Lauch AVG Anti-Spyware by double-clicking the icon on your desktop. Select the "Scanner " icon at the top and then the "Scan " tab
then click on "Complete System Scan ". ewido will now begin the scanning process, be patient this may take a little
time.
Once the scan is complete do the following: If you have any infections you will prompted, then select "Apply all
actions " Next select the "Reports " icon at the top. Select the "Save report as " button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important). Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the
results of the AVG Anti-Spyware report scan along with a new HijackThis log.
Okay here are the latest logs:
Logfile of HijackThis v1.99.1
Scan saved at 4:34:34 PM, on 11/20/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINNT\System32\wuauclt.exe
C:\WINNT\System32\wbem\wmiprvse.exe
F:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) -
http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————
+ Created at: 4:22:08 PM 11/20/2006
+ Scan result:
C:\Documents and Settings\All Users\Application Data\AutoSearch.dll -> Adware.AutoSearch : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP85\A0011993.exe -> Adware.Bagon : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP87\A0012107.dll -> Adware.CASClient : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP87\A0012114.exe -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP87\A0012115.exe -> Adware.DriveCleaner : Cleaned with backup (quarantined).
C:\Program Files\PSDream\PSDream.exe -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP85\A0012005.dll -> Adware.Softomate : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP85\A0012006.exe -> Adware.Softomate : Cleaned with backup (quarantined).
C:\WINNT\system32\pgbr3p.exe -> Adware.Suggestor : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP85\A0011995.exe -> Backdoor.Rbot : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\My Documents\Torrents\Spyware_Doctor_4.0.0.2620\sdsetup.exe -> Backdoor.VB.aym : Cleaned with backup (quarantined).
C:\WINNT\scvhost.exe -> Backdoor.VB.aym : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun22.exe -> Downloader.Adload.hm : Cleaned with backup (quarantined).
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun22.exe -> Downloader.Adload.hm : Cleaned with backup (quarantined).
C:\WINNT\system32\svchpm5.exe -> Downloader.Agent.asa : Cleaned with backup (quarantined).
C:\WINNT\28312045.exe -> Downloader.Agent.baf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP87\A0012117.exe -> Downloader.Dyfuca.ey : Cleaned with backup (quarantined).
C:\WINNT\system32\config\systemprofile\My Documents\Тasks\msiexec.exe -> Downloader.PurityScan.dm : Cleaned with backup (quarantined).
C:\dacmi.exe -> Downloader.Small.ctf : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP87\A0012128.exe -> Downloader.Small.cyh : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP83\A0011878.dll -> Downloader.Small.cyn : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP86\A0012051.dll -> Downloader.Small.cyn : Cleaned with backup (quarantined).
C:\WINNT\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Y1GRU5Q3\fred[1].exe -> Downloader.Small.cyq : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP87\A0012127.dll -> Downloader.Small.dxm : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP87\A0012113.exe -> Downloader.Tiny.em : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP87\A0012098.exe -> Hijacker.Small.ja : Cleaned with backup (quarantined).
C:\WINNT\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\AVQ9WD43\rsi[1].exe -> Hijacker.Small.ja : Cleaned with backup (quarantined).
C:\Program Files\Accessories\pokodezu.html -> Hijacker.Small.jf : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\UDC6_0001_D19M1908NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.m : Cleaned with backup (quarantined).
C:\rttdkor.exe -> Proxy.Dlena.aj : Cleaned with backup (quarantined).
C:\WINNT\system32\config\systemprofile\Cookies\system@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\WINNT\system32\config\systemprofile\Cookies\[removed][1].txt -> TrackingCookie.Adjuggler : Cleaned.
C:\WINNT\system32\config\systemprofile\Cookies\system@admarketplace[1].txt -> TrackingCookie.Admarketplace : Cleaned.
C:\WINNT\system32\config\systemprofile\Cookies\system@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.8:C:\Documents and Settings\Tessa\Application Data\Mozilla\Firefox\Profiles\59afx87t.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.
C:\WINNT\system32\config\systemprofile\Cookies\[removed][1].txt -> TrackingCookie.Searchingbooth : Cleaned.
C:\WINNT\system32\config\systemprofile\Cookies\[removed]-banners[1].txt -> TrackingCookie.Top-banners : Cleaned.
:mozilla.7:C:\Documents and Settings\Tessa\Application Data\Mozilla\Firefox\Profiles\59afx87t.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\WINNT\system32\config\systemprofile\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP87\A0012109.dll -> Trojan.Kolweb.b : Cleaned with backup (quarantined).
C:\WINNT\system32\durvil1.exe -> Trojan.Kolweb.b : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP83\A0011877.exe -> Trojan.Sinowal.bh : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\Australian govt draft says piracy stats are made up.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\Contact Us.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\Firefox plugin.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\How the MPAA knows where movies are Pirated.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\New York The Movie Pirate Capital.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\New layout.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\Privacy Prevails German ISP Forced To Delete IP Logs.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\Recover password.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\Register Now.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\Server Move.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\Software Piracy in 1985.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\Transmission 0.7 Beta - Redefining BitTorrent on the Mac.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\battlestar galactica.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\dark messiah.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\desperate housewives.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\family guy.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\gilmore girls.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\gothic 3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\grey s anatomy.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\greys anatomy.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\lost s03.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\lost s03e04.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\lost s03e05.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\miami vice.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\my chemical romance.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\my name is earl.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\need for speed carbon.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\need for speed.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\neverwinter nights 2.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\nip tuck.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\one tree hill.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\open season.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\prison break s02e09.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\prison break.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\pro evolution soccer 6.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\saw 3.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\south park.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\the departed.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\the oc.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\the office.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\the prestige.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\Complete\veronica mars.zip/Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\Documents and Settings\Tessa\My Documents\Setup.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{2B586437-DA75-483D-B0E7-155407429489}\RP85\A0011996.exe -> Worm.VB.dw : Cleaned with backup (quarantined).
::Report end
Thank you
With AVG Anti-Spyware, if you click on the Infections icon, then it will show you all the items in Quarrantine and you can remove them that way. Just click Select All (if all of the items in quarrantine need removing) then Remove Finally
Please download
AVG Anti-Rootkit to your desktop.
Double-click the installation file
Just click Next, let it go with default settings.
Once the installation is ready, reboot.
Run AVG Anti-Rootkit Beta.exe.
Click Search for rootkits.
When finished, click Save result to file.
Post back with the results. (Not sure where they are located, either in C:\Program Files\GRISOFT\AVG Anti-Rootkit Beta\ folder or on your desktop.)
Re-run combofix
Send:
- a fresh HijackThis log
- combofix report
- AVG Anti-Rootkit report
Also please describe how your computer behaves at the moment
Okay here goes….
Tessa - 06-11-20 23:01:45.69 Service Pack 1
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Tessa\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2006-10-20 to 2006-11-20 ))))))))))))))))))))))))))))))))))
2006-11-18 16:23 3,968 –a—— C:\WINNT\system32\drivers\AvgAsCln.sys
2006-11-18 00:16 29,696 –a—— C:\WINNT\system32\167982ld.exe
2006-11-17 21:53 29,696 –a—— C:\WINNT\system32\53432732ld.exe
2006-11-17 21:32 29,696 –a—— C:\WINNT\system32\32547982ld.exe
2006-11-17 21:12 29,696 –a—— C:\WINNT\system32\12298362ld.exe
2006-11-17 19:28 29,696 –a—— C:\WINNT\system32\28306052ld.exe
2006-11-17 19:08 29,696 –a—— C:\WINNT\system32\886072ld.exe
2006-11-17 18:41 29,696 –a—— C:\WINNT\system32\41219972ld.exe
2006-11-17 18:41 10,609 -r-h—– C:\WINNT\system32\tmp_2k4.exe
2006-11-17 18:41 10,609 –a—— C:\WINNT\system32\412192ld.exe
2006-11-17 18:03 29,696 –a—— C:\WINNT\system32\3102792ld.exe
2006-11-17 10:24 29,696 –a—— C:\WINNT\system32\24545722ld.exe
2006-11-17 10:03 29,696 –a—— C:\WINNT\system32\3555922ld.exe
2006-11-17 09:43 29,696 –a—— C:\WINNT\system32\43131452ld.exe
2006-11-17 09:22 29,696 –a—— C:\WINNT\system32\2212222ld.exe
2006-11-17 07:21 29,696 –a—— C:\WINNT\system32\21201142ld.exe
2006-11-17 07:00 29,696 –a—— C:\WINNT\system32\0224152ld.exe
2006-11-17 06:39 29,696 –a—— C:\WINNT\system32\39361832ld.exe
2006-11-17 06:19 29,696 –a—— C:\WINNT\system32\1984282ld.exe
2006-11-17 05:58 29,696 –a—— C:\WINNT\system32\5841132ld.exe
2006-11-17 05:38 29,696 –a—— C:\WINNT\system32\38196372ld.exe
2006-11-17 05:17 29,696 –a—— C:\WINNT\system32\17448212ld.exe
2006-11-17 04:57 29,696 –a—— C:\WINNT\system32\5713132ld.exe
2006-11-17 01:01 29,696 –a—— C:\WINNT\system32\1107362ld.exe
2006-11-17 00:40 29,696 –a—— C:\WINNT\system32\40468662ld.exe
2006-11-17 00:19 29,696 –a—— C:\WINNT\system32\19482062ld.exe
2006-11-16 23:59 29,696 –a—— C:\WINNT\system32\59286322ld.exe
2006-11-16 23:38 29,696 –a—— C:\WINNT\system32\38348792ld.exe
2006-11-16 23:17 29,696 –a—— C:\WINNT\system32\17385532ld.exe
2006-11-16 22:56 29,696 –a—— C:\WINNT\system32\56492772ld.exe
2006-11-16 22:37 29,696 –a—— C:\WINNT\system32\37114812ld.exe
2006-11-16 22:17 29,696 –a—— C:\WINNT\system32\1715712ld.exe
2006-11-16 22:11 47,104 –a—— C:\ATF-Cleaner.exe
2006-11-16 22:05 29,696 –a—— C:\WINNT\system32\5494852ld.exe
2006-11-16 21:45 29,696 –a—— C:\WINNT\system32\4541852ld.exe
2006-11-16 21:22 29,696 –a—— C:\WINNT\system32\22231992ld.exe
2006-11-16 10:36 29,696 –a—— C:\WINNT\system32\36423522ld.exe
2006-11-16 10:15 29,696 –a—— C:\WINNT\system32\15458552ld.exe
2006-11-16 09:55 29,696 –a—— C:\WINNT\system32\54599532ld.exe
2006-11-16 03:46 29,696 –a—— C:\WINNT\system32\46505802ld.exe
2006-11-16 02:58 29,696 –a—— C:\WINNT\system32\58144492ld.exe
2006-11-16 02:43 98,008 –a—— C:\WINNT\system32\ipv6monl.dll
2006-11-16 02:37 29,696 –a—— C:\WINNT\system32\37133662ld.exe
2006-11-15 23:43 29,696 –a—— C:\WINNT\system32\43524502ld.exe
2006-11-15 23:22 29,696 –a—— C:\WINNT\system32\22528182ld.exe
2006-11-15 23:01 29,696 –a—— C:\WINNT\system32\1493122ld.exe
2006-11-15 22:40 29,696 –a—— C:\WINNT\system32\4045242ld.exe
2006-11-15 22:18 29,696 –a—— C:\WINNT\system32\18337092ld.exe
2006-11-15 21:56 29,696 –a—— C:\WINNT\system32\56385582ld.exe
2006-11-15 21:53 29,696 –a—— C:\WINNT\system32\53532512ld.exe
2006-11-15 21:31 29,696 –a—— C:\WINNT\system32\31547052ld.exe
2006-11-15 21:26 991,232 –a—— C:\WINNT\system32\esent.dll
2006-11-15 17:19 29,696 –a—— C:\WINNT\system32\19346342ld.exe
2006-11-15 16:59 29,696 –a—— C:\WINNT\system32\5925132ld.exe
2006-11-15 14:31 29,696 –a—— C:\WINNT\system32\31252662ld.exe
2006-11-15 14:09 29,696 –a—— C:\WINNT\system32\922052ld.exe
2006-11-15 14:06 29,696 –a—— C:\WINNT\system32\6222652ld.exe
2006-11-15 14:03 29,696 –a—— C:\WINNT\system32\3577872ld.exe
2006-11-15 14:01 29,696 –a—— C:\WINNT\system32\1354432ld.exe
2006-11-15 13:59 29,696 –a—— C:\WINNT\system32\59306032ld.exe
2006-11-15 13:57 29,696 –a—— C:\WINNT\system32\57282472ld.exe
2006-11-15 13:54 29,696 –a—— C:\WINNT\system32\54536052ld.exe
2006-11-15 13:33 29,696 –a—— C:\WINNT\system32\33523612ld.exe
2006-11-14 21:38 98,304 –a—— C:\WINNT\system32\oleprn.dll
2006-11-14 21:38 94,208 –a—— C:\WINNT\system32\odbccp32.dll
2006-11-14 21:38 91,136 –a—— C:\WINNT\system32\rastls.dll
2006-11-14 21:38 9,216 –a—— C:\WINNT\system32\wuauserv.dll
2006-11-14 21:38 891,711 ——— C:\WINNT\system32\drivers\nv4_mini.sys
2006-11-14 21:38 88,064 –a—— C:\WINNT\system32\tscfgwmi.dll
2006-11-14 21:38 87,304 –a—— C:\WINNT\system32\rdpdd.dll
2006-11-14 21:38 86,528 –a—— C:\WINNT\system32\wlnotify.dll
2006-11-14 21:38 86,016 –a—— C:\WINNT\system32\xactsrv.dll
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\smlogsvc.exe
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\psbase.dll
2006-11-14 21:38 81,920 –a—— C:\WINNT\system32\trkwks.dll
2006-11-14 21:38 8,192 –a—— C:\WINNT\system32\scrnsave.scr
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpstub.exe
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpshell.dll
2006-11-14 21:38 75,912 –a—— C:\WINNT\system32\rdpwsx.dll
2006-11-14 21:38 74,240 –a—— C:\WINNT\system32\rtcshare.exe
2006-11-14 21:38 72,192 –a—— C:\WINNT\system32\telnet.exe
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\storprop.dll
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\sdbinst.exe
2006-11-14 21:38 686,080 –a—— C:\WINNT\system32\opengl32.dll
2006-11-14 21:38 667,648 –a—— C:\WINNT\system32\ss3dfo.scr
2006-11-14 21:38 66,560 –a—— C:\WINNT\system32\spoolss.dll
2006-11-14 21:38 66,048 –a—— C:\WINNT\system32\sigverif.exe
2006-11-14 21:38 638,976 –a—— C:\WINNT\system32\sstext3d.scr
2006-11-14 21:38 63,488 –a—— C:\WINNT\system32\srclient.dll
2006-11-14 21:38 62,976 –a—— C:\WINNT\system32\shgina.dll
2006-11-14 21:38 61,952 –a—— C:\WINNT\system32\sti.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccu32.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccr32.dll
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\wextract.exe
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\shimeng.dll
2006-11-14 21:38 6,144 –a—— C:\WINNT\system32\sensapi.dll
2006-11-14 21:38 58,880 –a—— C:\WINNT\system32\pautoenr.dll
2006-11-14 21:38 57,856 –a—— C:\WINNT\system32\raschap.dll
2006-11-14 21:38 569,344 –a—— C:\WINNT\system32\sspipes.scr
2006-11-14 21:38 56,832 –a—— C:\WINNT\system32\wzcdlg.dll
2006-11-14 21:38 56,320 –a—— C:\WINNT\system32\remotepg.dll
2006-11-14 21:38 548,864 –a—— C:\WINNT\system32\rtcdll.dll
2006-11-14 21:38 534,016 –a—— C:\WINNT\system32\spider.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\packager.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\odbcconf.exe
2006-11-14 21:38 52,224 –a—— C:\WINNT\system32\secur32.dll
2006-11-14 21:38 511,488 –a—— C:\WINNT\system32\qedit.dll
2006-11-14 21:38 51,200 –a—— C:\WINNT\system32\wmerrenu.dll
2006-11-14 21:38 5,504 ——— C:\WINNT\system32\drivers\smbali.sys
2006-11-14 21:38 48,640 –a—— C:\WINNT\system32\vdmredir.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\winsta.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\reg.exe
2006-11-14 21:38 479,261 –a—— C:\WINNT\system32\vbscript.dll
2006-11-14 21:38 47,616 –a—— C:\WINNT\system32\utilman.exe
2006-11-14 21:38 446,464 –a—— C:\WINNT\system32\wmvdmoe.dll
2006-11-14 21:38 442,398 –a—— C:\WINNT\system32\wmadmoe.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\regapi.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\rdpclip.exe
2006-11-14 21:38 43,008 –a—— C:\WINNT\system32\ssdpsrv.dll
2006-11-14 21:38 423,424 –a—— C:\WINNT\system32\riched20.dll
2006-11-14 21:38 420,864 –a—— C:\WINNT\system32\shimgvw.dll
2006-11-14 21:38 409,088 –a—— C:\WINNT\system32\vssapi.dll
2006-11-14 21:38 40,960 –a—— C:\WINNT\system32\tscupgrd.exe
2006-11-14 21:38 392,704 –a—— C:\WINNT\system32\ntmssvc.dll
2006-11-14 21:38 385,024 –a—— C:\WINNT\system32\sqlsrv32.dll
2006-11-14 21:38 384,000 –a—— C:\WINNT\system32\themeui.dll
2006-11-14 21:38 38,912 –a—— C:\WINNT\system32\wsnmp32.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntmsapi.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntlanman.dll
2006-11-14 21:38 364,544 –a—— C:\WINNT\system32\ssflwbox.scr
2006-11-14 21:38 36,352 –a—— C:\WINNT\system32\sens.dll
2006-11-14 21:38 357,376 –a—— C:\WINNT\system32\qdvd.dll
2006-11-14 21:38 34,304 –a—— C:\WINNT\system32\rcimlby.exe
2006-11-14 21:38 339,456 –a—— C:\WINNT\system32\usp10.dll
2006-11-14 21:38 334,848 –a—— C:\WINNT\system32\smlogcfg.dll
2006-11-14 21:38 33,280 –a—— C:\WINNT\system32\shmgrate.exe
2006-11-14 21:38 32,768 –a—— C:\WINNT\system32\odbcad32.exe
2006-11-14 21:38 32,256 –a—— C:\WINNT\system32\umandlg.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\zipfldr.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\wiaservc.dll
2006-11-14 21:38 311,327 –a—— C:\WINNT\system32\wmv8dmod.dll
2006-11-14 21:38 31,744 –a—— C:\WINNT\system32\pid.dll
2006-11-14 21:38 3,494,303 ——— C:\WINNT\system32\nv4_disp.dll
2006-11-14 21:38 3,338 –a—— C:\WINNT\system32\redir.exe
2006-11-14 21:38 297,984 –a—— C:\WINNT\system32\scesrv.dll
2006-11-14 21:38 296,448 –a—— C:\WINNT\system32\wmstream.dll
2006-11-14 21:38 294,912 –a—— C:\WINNT\system32\wmvdmod.dll
2006-11-14 21:38 274,432 –a—— C:\WINNT\system32\wmasf.dll
2006-11-14 21:38 27,136 –a—— C:\WINNT\system32\ssdpapi.dll
2006-11-14 21:38 266,752 –a—— C:\WINNT\winhlp32.exe
2006-11-14 21:38 264,704 –a—— C:\WINNT\system32\wzcsvc.dll
2006-11-14 21:38 258,048 –a—— C:\WINNT\system32\webcheck.dll
2006-11-14 21:38 254,976 –a—— C:\WINNT\system32\pdh.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmpcd.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmnetmgr.dll
2006-11-14 21:38 251,904 –a—— C:\WINNT\system32\strmdll.dll
2006-11-14 21:38 247,808 –a—— C:\WINNT\system32\wow32.dll
2006-11-14 21:38 24,576 –a—— C:\WINNT\system32\odbcbcp.dll
2006-11-14 21:38 24,064 –a—— C:\WINNT\system32\skeys.exe
2006-11-14 21:38 231,424 –a—— C:\WINNT\system32\upnpui.dll
2006-11-14 21:38 23,552 –a—— C:\WINNT\system32\wzcsapi.dll
2006-11-14 21:38 226,816 –a—— C:\WINNT\system32\srrstr.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\slayerxp.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\shfolder.dll
2006-11-14 21:38 22,016 –a—— C:\WINNT\system32\udhisapi.dll
2006-11-14 21:38 212,480 –a—— C:\WINNT\system32\osk.exe
2006-11-14 21:38 203,264 –a—— C:\WINNT\system32\uxtheme.dll
2006-11-14 21:38 200,704 –a—— C:\WINNT\system32\odbc32.dll
2006-11-14 21:38 200,192 –a—— C:\WINNT\system32\termsrv.dll
2006-11-14 21:38 20,992 –a—— C:\WINNT\system32\setup.exe
2006-11-14 21:38 193,536 –a—— C:\WINNT\system32\rasppp.dll
2006-11-14 21:38 19,456 –a—— C:\WINNT\system32\ssmarque.scr
2006-11-14 21:38 184,832 –a—— C:\WINNT\system32\qcap.dll
2006-11-14 21:38 184,320 –a—— C:\WINNT\system32\wmadmod.dll
2006-11-14 21:38 18,944 –a—— C:\WINNT\system32\ssbezier.scr
2006-11-14 21:38 174,592 –a—— C:\WINNT\system32\scecli.dll
2006-11-14 21:38 172,664 –a—— C:\WINNT\system32\xenroll.dll
2006-11-14 21:38 171,520 –a—— C:\WINNT\system32\winmm.dll
2006-11-14 21:38 171,008 –a—— C:\WINNT\system32\sccsccp.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\wtsapi32.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\ssmyst.scr
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\psapi.dll
2006-11-14 21:38 169,984 –a—— C:\WINNT\system32\sccbase.dll
2006-11-14 21:38 168,448 –a—— C:\WINNT\system32\wldap32.dll
2006-11-14 21:38 165,888 –a—— C:\WINNT\system32\ntmsdba.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\w32time.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\tapi32.dll
2006-11-14 21:38 164,864 –a—— C:\WINNT\system32\upnphost.dll
2006-11-14 21:38 16,896 –a—— C:\WINNT\system32\snmpapi.dll
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\watchdog.sys
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ups.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ping.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\odbc32gt.dll
2006-11-14 21:38 159,232 –a—— C:\WINNT\system32\schedsvc.dll
2006-11-14 21:38 158,720 –a—— C:\WINNT\system32\srsvc.dll
2006-11-14 21:38 147,456 –a—— C:\WINNT\system32\odbctrac.dll
2006-11-14 21:38 14,848 –a—— C:\WINNT\system32\rdpsnd.dll
2006-11-14 21:38 137,216 –a—— C:\WINNT\system32\ntshrui.dll
2006-11-14 21:38 135,680 –a—— C:\WINNT\system32\rdchost.dll
2006-11-14 21:38 134,144 –a—— C:\WINNT\regedit.exe
2006-11-14 21:38 133,632 –a—— C:\WINNT\system32\rsaenh.dll
2006-11-14 21:38 133,120 –a—— C:\WINNT\system32\sfc_os.dll
2006-11-14 21:38 130,560 –a—— C:\WINNT\system32\sti_ci.dll
2006-11-14 21:38 13,824 –a—— C:\WINNT\system32\rassapi.dll
2006-11-14 21:38 13,312 –a—— C:\WINNT\system32\ssstars.scr
2006-11-14 21:38 128,512 –a—— C:\WINNT\system32\taskmgr.exe
2006-11-14 21:38 124,928 –a—— C:\WINNT\system32\webvw.dll
2006-11-14 21:38 122,880 –a—— C:\WINNT\system32\odbcconf.dll
2006-11-14 21:38 120,320 –a—— C:\WINNT\system32\upnp.dll
2006-11-14 21:38 12,800 –a—— C:\WINNT\system32\runonce.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\rdsaddin.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\odbcp32r.dll
2006-11-14 21:38 119,808 –a—— C:\WINNT\system32\wiadss.dll
2006-11-14 21:38 118,784 –a—— C:\WINNT\system32\wmsdmoe.dll
2006-11-14 21:38 117,760 –a—— C:\WINNT\system32\stobject.dll
2006-11-14 21:38 112,128 –a—— C:\WINNT\system32\ntmarta.dll
2006-11-14 21:38 110,592 –a—— C:\WINNT\system32\wmsdmod.dll
2006-11-14 21:38 11,776 –a—— C:\WINNT\system32\sigtab.dll
2006-11-14 21:38 109,568 –a—— C:\WINNT\system32\offfilt.dll
2006-11-14 21:38 106,496 –a—— C:\WINNT\system32\url.dll
2006-11-14 21:38 10,752 –a—— C:\WINNT\system32\tracert.exe
2006-11-14 21:38 10,752 –a—— C:\WINNT\hh.exe
2006-11-14 21:38 1,998,848 –a—— C:\WINNT\system32\wmploc.dll
2006-11-14 21:38 1,350,144 –a—— C:\WINNT\system32\query.dll
2006-11-14 21:38 1,298,432 –a—— C:\WINNT\system32\wmpcore.dll
2006-11-14 21:38 1,220,608 –a—— C:\WINNT\system32\wmvcore.dll
2006-11-14 21:38 1,157,632 –a—— C:\WINNT\system32\sfcfiles.dll
2006-11-14 21:37 95,744 –a—— C:\WINNT\system32\nlhtml.dll
2006-11-14 21:37 921,475 ——— C:\WINNT\system32\ati3d2ag.dll
2006-11-14 21:37 91,136 –a—— C:\WINNT\system32\MSOERT2.DLL
2006-11-14 21:37 9,728 –a—— C:\WINNT\system32\mstinit.exe
2006-11-14 21:37 857,600 –a—— C:\WINNT\system32\netplwiz.dll
2006-11-14 21:37 844,675 ——— C:\WINNT\system32\ati3d1ag.dll
2006-11-14 21:37 699,392 –a—— C:\WINNT\system32\msxml2.dll
2006-11-14 21:37 68,608 –a—— C:\WINNT\system32\mscms.dll
2006-11-14 21:37 67,584 –a—— C:\WINNT\system32\msctfp.dll
2006-11-14 21:37 65,536 –a—— C:\WINNT\system32\msconf.dll
2006-11-14 21:37 63,663 –a—— C:\WINNT\system32\drivers\atinrvxx.sys
2006-11-14 21:37 6,912 ——— C:\WINNT\system32\drivers\hidir.sys
2006-11-14 21:37 6,656 –a—— C:\WINNT\system32\laprxy.dll
2006-11-14 21:37 598,016 –a—— C:\WINNT\system32\mstscax.dll
2006-11-14 21:37 584,192 –a—— C:\WINNT\system32\netcfgx.dll
2006-11-14 21:37 57,856 –a—— C:\WINNT\system32\licwmi.dll
2006-11-14 21:37 56,591 –a—— C:\WINNT\system32\drivers\atinbtxx.sys
2006-11-14 21:37 56,320 –a—— C:\WINNT\system32\mshtmler.dll
2006-11-14 21:37 552,991 –a—— C:\WINNT\system32\msrepl40.dll
2006-11-14 21:37 512,031 –a—— C:\WINNT\system32\msexch40.dll
2006-11-14 21:37 504,832 ——— C:\WINNT\system32\msftedit.dll
2006-11-14 21:37 504,320 –a—— C:\WINNT\system32\logonui.exe
2006-11-14 21:37 5,120 ——— C:\WINNT\system32\hccoin.dll
2006-11-14 21:37 49,152 –a—— C:\WINNT\system32\npptools.dll
2006-11-14 21:37 450,176 ——— C:\WINNT\system32\drivers\ati2mtag.sys
2006-11-14 21:37 421,919 –a—— C:\WINNT\system32\msrd2x40.dll
2006-11-14 21:37 42,496 –a—— C:\WINNT\system32\ncobjapi.dll
2006-11-14 21:37 403,456 ——— C:\WINNT\system32\winbrand.dll
2006-11-14 21:37 401,462 –a—— C:\WINNT\system32\msvcp60.dll
2006-11-14 21:37 4,608 –a—— C:\WINNT\system32\msimg32.dll
2006-11-14 21:37 4,126 –a—— C:\WINNT\system32\msdxmlc.dll
2006-11-14 21:37 399,360 –a—— C:\WINNT\system32\netlogon.dll
2006-11-14 21:37 39,424 –a—— C:\WINNT\system32\net.exe
2006-11-14 21:37 388,608 –a—— C:\WINNT\system32\mstsc.exe
2006-11-14 21:37 381,440 –a—— C:\WINNT\system32\lmrt.dll
2006-11-14 21:37 377,984 –a—— C:\WINNT\system32\ati2dvaa.dll
2006-11-14 21:37 368,710 –a—— C:\WINNT\system32\msisam11.dll
2006-11-14 21:37 36,463 –a—— C:\WINNT\system32\drivers\atintuxx.sys
2006-11-14 21:37 348,195 –a—— C:\WINNT\system32\msjetoledb40.dll
2006-11-14 21:37 348,191 –a—— C:\WINNT\system32\mspbde40.dll
2006-11-14 21:37 344,095 –a—— C:\WINNT\system32\msxbde40.dll
2006-11-14 21:37 34,735 –a—— C:\WINNT\system32\drivers\atinxsxx.sys
2006-11-14 21:37 339,968 –a—— C:\WINNT\system32\mspaint.exe
2006-11-14 21:37 33,808 –a—— C:\WINNT\system32\ntio.sys
2006-11-14 21:37 327,040 –a—— C:\WINNT\system32\drivers\ati2mtaa.sys
2006-11-14 21:37 326,656 –a—— C:\WINNT\system32\netsetup.exe
2006-11-14 21:37 323,072 –a—— C:\WINNT\system32\msvcrt.dll
2006-11-14 21:37 32,256 –a—— C:\WINNT\system32\mnmdd.dll
2006-11-14 21:37 319,760 –a—— C:\WINNT\system32\msnsspc.dll
2006-11-14 21:37 319,519 –a—— C:\WINNT\system32\msexcl40.dll
2006-11-14 21:37 30,671 –a—— C:\WINNT\system32\drivers\atinraxx.sys
2006-11-14 21:37 3,584 ——— C:\WINNT\system32\dsprpres.dll
2006-11-14 21:37 29,455 –a—— C:\WINNT\system32\drivers\atinxbxx.sys
2006-11-14 21:37 266,752 –a—— C:\WINNT\system32\msctf.dll
2006-11-14 21:37 26,367 –a—— C:\WINNT\system32\drivers\atinsnxx.sys
2006-11-14 21:37 253,983 –a—— C:\WINNT\system32\mstext40.dll
2006-11-14 21:37 250,368 –a—— C:\WINNT\system32\mstask.dll
2006-11-14 21:37 241,725 –a—— C:\WINNT\system32\msuni11.dll
2006-11-14 21:37 241,695 –a—— C:\WINNT\system32\msjtes40.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\nmmkcert.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\logagent.exe
2006-11-14 21:37 238,080 –a—— C:\WINNT\system32\newdev.dll
2006-11-14 21:37 233,472 –a—— C:\WINNT\system32\mpg4dmod.dll
2006-11-14 21:37 230,400 –a—— C:\WINNT\system32\msieftp.dll
2006-11-14 21:37 229,376 –a—— C:\WINNT\system32\MSOEACCT.DLL
2006-11-14 21:37 22,528 –a—— C:\WINNT\system32\mslbui.dll
2006-11-14 21:37 219,648 –a—— C:\WINNT\system32\logon.scr
2006-11-14 21:37 218,112 ——— C:\WINNT\system32\sbe.dll
2006-11-14 21:37 213,023 –a—— C:\WINNT\system32\msltus40.dll
2006-11-14 21:37 210,944 –a—— C:\WINNT\system32\moricons.dll
2006-11-14 21:37 21,343 ——— C:\WINNT\system32\drivers\atinttxx.sys
2006-11-14 21:37 202,496 ——— C:\WINNT\system32\ati2dvag.dll
2006-11-14 21:37 196,096 –a—— C:\WINNT\system32\mobsync.dll
2006-11-14 21:37 192,512 –a—— C:\WINNT\system32\mswebdvd.dll
2006-11-14 21:37 19,456 –a—— C:\WINNT\system32\licmgr10.dll
2006-11-14 21:37 19,328 ——— C:\WINNT\system32\drivers\usbehci.sys
2006-11-14 21:37 187,904 ——— C:\WINNT\system32\xpsp1res.dll
2006-11-14 21:37 182,784 –a—— C:\WINNT\system32\msutb.dll
2006-11-14 21:37 18,944 ——— C:\WINNT\system32\faxpatch.exe
2006-11-14 21:37 174,592 –a—— C:\WINNT\system32\msnetobj.dll
2006-11-14 21:37 172,032 ——— C:\WINNT\system32\mssap.dll
2006-11-14 21:37 163,840 –a—— C:\WINNT\system32\mindex.dll
2006-11-14 21:37 16,384 –a—— C:\WINNT\system32\nddenb32.dll
2006-11-14 21:37 155,648 ——— C:\WINNT\system32\encdec.dll
2006-11-14 21:37 143,872 –a—— C:\WINNT\system32\msimtf.dll
2006-11-14 21:37 131,072 –a—— C:\WINNT\system32\msorcl32.dll
2006-11-14 21:37 13,056 ——— C:\WINNT\system32\drivers\wacompen.sys
2006-11-14 21:37 126,976 –a—— C:\WINNT\system32\msdart.dll
2006-11-14 21:37 12,288 –a—— C:\WINNT\system32\mscpx32r.dll
2006-11-14 21:37 12,288 ——— C:\WINNT\system32\encapi.dll
2006-11-14 21:37 12,047 ——— C:\WINNT\system32\drivers\atinpdxx.sys
2006-11-14 21:37 116,736 –a—— C:\WINNT\system32\mplay32.exe
2006-11-14 21:37 115,200 –a—— C:\WINNT\system32\net1.exe
2006-11-14 21:37 113,664 –a—— C:\WINNT\system32\msvfw32.dll
2006-11-14 21:37 110,080 ——— C:\WINNT\system32\sbeio.dll
2006-11-14 21:37 11,904 ——— C:\WINNT\system32\drivers\mutohpen.sys
2006-11-14 21:37 11,615 –a—— C:\WINNT\system32\drivers\atinmdxx.sys
2006-11-14 21:37 105,984 –a—— C:\WINNT\system32\netdde.exe
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\msrle32.dll
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\localui.dll
2006-11-14 21:37 1,677,312 ——— C:\WINNT\system32\wmvcore2.dll
2006-11-14 21:37 1,622,528 –a—— C:\WINNT\system32\netshell.dll
2006-11-14 21:37 1,503,262 –a—— C:\WINNT\system32\msjet40.dll
2006-11-14 21:37 1,220,608 –a—— C:\WINNT\system32\msvidctl.dll
2006-11-14 21:37 1,128,960 –a—— C:\WINNT\system32\mmcndmgr.dll
2006-11-14 21:36 98,816 –a—— C:\WINNT\system32\clipbrd.exe
2006-11-14 21:36 94,720 –a—— C:\WINNT\system32\dmusic.dll
2006-11-14 21:36 91,648 –a—— C:\WINNT\system32\iuctl.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\icaapi.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\dumprep.exe
2006-11-14 21:36 88,576 –a—— C:\WINNT\system32\mqsec.dll
2006-11-14 21:36 802,304 –a—— C:\WINNT\system32\dxmrtp.dll
2006-11-14 21:36 8,832 –a—— C:\WINNT\system32\framebuf.dll
2006-11-14 21:36 786,432 –a—— C:\WINNT\system32\dxdiag.exe
2006-11-14 21:36 77,312 –a—— C:\WINNT\system32\dmscript.dll
2006-11-14 21:36 76,830 –a—— C:\WINNT\system32\drmstor.dll
2006-11-14 21:36 76,288 –a—— C:\WINNT\system32\dfrgfat.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\tlntsess.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\ils.dll
2006-11-14 21:36 70,656 –a—— C:\WINNT\system32\defrag.exe
2006-11-14 21:36 70,144 –a—— C:\WINNT\system32\cryptdlg.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\tlntsvrp.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\fxsperf.dll
2006-11-14 21:36 7,040 –a—— C:\WINNT\system32\kd1394.dll
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\tlntsvr.exe
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\fdeploy.dll
2006-11-14 21:36 67,456 –a—— C:\WINNT\system32\drivers\mqac.sys
2006-11-14 21:36 66,560 –a—— C:\WINNT\system32\faultrep.dll
2006-11-14 21:36 61,440 –a—— C:\WINNT\system32\dbnetlib.dll
2006-11-14 21:36 608,768 –a—— C:\WINNT\system32\mqqm.dll
2006-11-14 21:36 602,112 –a—— C:\WINNT\system32\drmv2clt.dll
2006-11-14 21:36 6,656 –a—— C:\WINNT\system32\fxsres.dll
2006-11-14 21:36 596,480 –a—— C:\WINNT\system32\INETCOMM.DLL
2006-11-14 21:36 59,392 –a—— C:\WINNT\system32\iesetup.dll
2006-11-14 21:36 58,368 –a—— C:\WINNT\system32\dpvsetup.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\tlntadmn.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\nwwks.dll
2006-11-14 21:36 57,344 –a—— C:\WINNT\system32\dmcompos.dll
2006-11-14 21:36 56,320 –a—— C:\WINNT\system32\dpnhupnp.dll
2006-11-14 21:36 559,616 –a—— C:\WINNT\system32\fxsst.dll
2006-11-14 21:36 55,296 –a—— C:\WINNT\system32\digest.dll
2006-11-14 21:36 545,792 –a—— C:\WINNT\system32\wsecedit.dll
2006-11-14 21:36 54,272 –a—— C:\WINNT\system32\clusapi.dll
2006-11-14 21:36 53,248 –a—— C:\WINNT\system32\cryptsvc.dll
2006-11-14 21:36 51,712 –a—— C:\WINNT\system32\ipconfig.exe
2006-11-14 21:36 498,205 –a—— C:\WINNT\system32\dxmasf.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\ixsso.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\dpwsockx.dll
2006-11-14 21:36 49,152 –a—— C:\WINNT\system32\eventlog.dll
2006-11-14 21:36 489,984 –a—— C:\WINNT\system32\dbghelp.dll
2006-11-14 21:36 478,720 –a—— C:\WINNT\system32\mqsnap.dll
2006-11-14 21:36 471,040 –a—— C:\WINNT\system32\cryptui.dll
2006-11-14 21:36 467,456 –a—— C:\WINNT\system32\mqutil.dll
2006-11-14 21:36 45,568 –a—— C:\WINNT\system32\docprop2.dll
2006-11-14 21:36 443,392 –a—— C:\WINNT\system32\fxsapi.dll
2006-11-14 21:36 435,200 –a—— C:\WINNT\system32\ipnathlp.dll
2006-11-14 21:36 42,537 –a—— C:\WINNT\system32\keyboard.sys
2006-11-14 21:36 41,472 –a—— C:\WINNT\system32\cmdl32.exe
2006-11-14 21:36 395,264 –a—— C:\WINNT\system32\fxsxp32.dll
2006-11-14 21:36 391,168 –a—— C:\WINNT\system32\fxstiff.dll
2006-11-14 21:36 380,445 –a—— C:\WINNT\system32\expsrv.dll
2006-11-14 21:36 38,912 –a—— C:\WINNT\system32\hhsetup.dll
2006-11-14 21:36 36,922 –a—— C:\WINNT\system32\imeshare.dll
2006-11-14 21:36 35,328 –a—— C:\WINNT\system32\dfrgsnap.dll
2006-11-14 21:36 324,608 –a—— C:\WINNT\system32\cmdial32.dll
2006-11-14 21:36 318,464 –a—— C:\WINNT\system32\ippromon.dll
2006-11-14 21:36 31,744 –a—— C:\WINNT\system32\dmloader.dll
2006-11-14 21:36 307,712 –a—— C:\WINNT\system32\cscui.dll
2006-11-14 21:36 30,208 –a—— C:\WINNT\system32\imgutil.dll
2006-11-14 21:36 294,912 –a—— C:\WINNT\system32\iedkcs32.dll
2006-11-14 21:36 29,696 –a—— C:\WINNT\system32\dpnhpast.dll
2006-11-14 21:36 29,696 ——— C:\WINNT\system32\asr_pfu.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\ie4uinit.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\dbnmpntw.dll
2006-11-14 21:36 28,160 –a—— C:\WINNT\system32\pidgen.dll
2006-11-14 21:36 277,504 –a—— C:\WINNT\system32\appmgr.dll
2006-11-14 21:36 271,360 –a—— C:\WINNT\system32\fxscomex.dll
2006-11-14 21:36 266,240 –a—— C:\WINNT\system32\drmclien.dll
2006-11-14 21:36 263,680 –a—— C:\WINNT\system32\duser.dll
2006-11-14 21:36 263,168 –a—— C:\WINNT\system32\devmgr.dll
2006-11-14 21:36 26,112 –a—— C:\WINNT\system32\dmband.dll
2006-11-14 21:36 253,440 –a—— C:\WINNT\system32\ddraw.dll
2006-11-14 21:36 250,368 –a—— C:\WINNT\system32\fxssvc.exe
2006-11-14 21:36 25,600 –a—— C:\WINNT\system32\dfsshlex.dll
2006-11-14 21:36 249,856 –a—— C:\WINNT\system32\adsiis.dll
2006-11-14 21:36 240,640 –a—— C:\WINNT\system32\hnetcfg.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsvinn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsrpcn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\conime.exe
2006-11-14 21:36 24,064 –a—— C:\WINNT\system32\fxsdrv.dll
2006-11-14 21:36 238,592 –a—— C:\WINNT\system32\compatui.dll
2006-11-14 21:36 237,056 –a—— C:\WINNT\system32\icm32.dll
2006-11-14 21:36 236,032 –a—— C:\WINNT\system32\fxst30.dll
2006-11-14 21:36 231,936 –a—— C:\WINNT\system32\tracerpt.exe
2006-11-14 21:36 227,840 –a—— C:\WINNT\system32\dsquery.dll
2006-11-14 21:36 216,064 –a—— C:\WINNT\system32\fxscover.exe
2006-11-14 21:36 206,336 –a—— C:\WINNT\system32\dpvoice.dll
2006-11-14 21:36 204,288 –a—— C:\WINNT\system32\ieaksie.dll
2006-11-14 21:36 20,992 –a—— C:\WINNT\system32\fxsext32.dll
2006-11-14 21:36 20,480 –a—— C:\WINNT\system32\dbmsadsn.dll
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\fontview.exe
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\ersvc.dll
2006-11-14 21:36 185,856 –a—— C:\WINNT\system32\fxswzrd.dll
2006-11-14 21:36 183,808 –a—— C:\WINNT\system32\gptext.dll
2006-11-14 21:36 180,224 –a—— C:\WINNT\system32\dwwin.exe
2006-11-14 21:36 178,688 –a—— C:\WINNT\system32\eudcedit.exe
2006-11-14 21:36 172,544 –a—— C:\WINNT\system32\dmime.dll
2006-11-14 21:36 17,792 ——— C:\WINNT\system32\drivers\irbus.sys
2006-11-14 21:36 168,960 –a—— C:\WINNT\system32\dinput8.dll
2006-11-14 21:36 165,888 –a—— C:\WINNT\system32\mqrt.dll
2006-11-14 21:36 165,376 –a—— C:\WINNT\system32\els.dll
2006-11-14 21:36 164,352 –a—— C:\WINNT\system32\mqtrig.dll
2006-11-14 21:36 16,384 –a—— C:\WINNT\system32\ds32gt.dll
2006-11-14 21:36 158,720 –a—— C:\WINNT\system32\credui.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\dpnet.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\appmgmts.dll
2006-11-14 21:36 156,544 –a—— C:\WINNT\system32\drivers\nwrdr.sys
2006-11-14 21:36 151,552 –a—— C:\WINNT\system32\dinput.dll
2006-11-14 21:36 149,504 –a—— C:\WINNT\system32\fxsui.dll
2006-11-14 21:36 143,872 –a—— C:\WINNT\system32\itircl.dll
2006-11-14 21:36 14,848 –a—— C:\WINNT\system32\mqise.dll
2006-11-14 21:36 135,680 –a—— C:\WINNT\system32\dsprop.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\mqad.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\fxsclnt.exe
2006-11-14 21:36 13,312 –a—— C:\WINNT\system32\ctfmon.exe
2006-11-14 21:36 128,000 –a—— C:\WINNT\system32\itss.dll
2006-11-14 21:36 126,976 –a—— C:\WINNT\system32\ieakeng.dll
2006-11-14 21:36 124,928 –a—— C:\WINNT\system32\dssenh.dll
2006-11-14 21:36 123,904 –a—— C:\WINNT\system32\imapi.exe
2006-11-14 21:36 115,200 –a—— C:\WINNT\system32\dpcdll.dll
2006-11-14 21:36 114,176 –a—— C:\WINNT\system32\input.dll
2006-11-14 21:36 113,664 –a—— C:\WINNT\system32\schtasks.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\idq.dll
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\gpresult.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\dfrgui.dll
2006-11-14 21:36 110,080 –a—— C:\WINNT\system32\dmstyle.dll
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\rsnotify.exe
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\imm32.dll
2006-11-14 21:36 103,424 –a—— C:\WINNT\system32\dgnet.dll
2006-11-14 21:36 10,752 ——— C:\WINNT\system32\spiisupd.exe
2006-11-14 21:36 1,180,672 –a—— C:\WINNT\system32\d3d8.dll
2006-11-14 21:36 1,004,032 –a—— C:\WINNT\explorer.exe
2006-11-14 21:35 91,648 –a—— C:\WINNT\system32\ahui.exe
2006-11-14 21:35 91,136 –a—— C:\WINNT\system32\advpack.dll
2006-11-14 21:35 8,192 –a—— C:\WINNT\system32\autolfn.exe
2006-11-14 21:35 76,288 –a—— C:\WINNT\system32\avifil32.dll
2006-11-14 21:35 74,810 –a—— C:\WINNT\system32\atl.dll
2006-11-14 21:35 71,680 –a—— C:\WINNT\system32\browsewm.dll
2006-11-14 21:35 64,512 –a—— C:\WINNT\system32\ciodm.dll
2006-11-14 21:35 62,976 –a—— C:\WINNT\system32\browselc.dll
2006-11-14 21:35 62,464 –a—— C:\WINNT\system32\adsmsext.dll
2006-11-14 21:35 6,656 –a—— C:\WINNT\system32\batt.dll
2006-11-14 21:35 59,904 –a—— C:\WINNT\system32\cabinet.dll
2006-11-14 21:35 5,120 –a—— C:\WINNT\system32\asferror.dll
2006-11-14 21:35 49,152 –a—— C:\WINNT\system32\browser.dll
2006-11-14 21:35 41,984 –a—— C:\WINNT\system32\alg.exe
2006-11-14 21:35 38,912 –a—— C:\WINNT\system32\audiosrv.dll
2006-11-14 21:35 32,768 –a—— C:\WINNT\system32\cfgbkend.dll
2006-11-14 21:35 32,512 ——— C:\WINNT\system32\drivers\amdk7.sys
2006-11-14 21:35 239,616 –a—— C:\WINNT\system32\adsnt.dll
2006-11-14 21:35 22,528 –a—— C:\WINNT\system32\at.exe
2006-11-14 21:35 186,880 –a—— C:\WINNT\system32\certcli.dll
2006-11-14 21:35 162,816 –a—— C:\WINNT\system32\adsldp.dll
2006-11-14 21:35 14,366 –a—— C:\WINNT\system32\asfsipc.dll
2006-11-14 21:35 139,776 –a—— C:\WINNT\system32\adsldpc.dll
2006-11-14 21:35 115,712 –a—— C:\WINNT\system32\apphelp.dll
2006-11-14 20:57 29,696 –a—— C:\WINNT\system32\57484702ld.exe
2006-11-14 20:36 29,696 –a—— C:\WINNT\system32\36532452ld.exe
2006-11-14 20:30 29,696 –a—— C:\WINNT\system32\30377002ld.exe
2006-11-14 20:19 593,408 –a—— C:\WINNT\system32\h323msp.dll
2006-11-14 20:15 97,280 –a—— C:\WINNT\system32\txflog.dll
2006-11-14 20:10 29,696 –a—— C:\WINNT\system32\10107562ld.exe
2006-11-14 19:49 29,696 –a—— C:\WINNT\system32\49432912ld.exe
2006-11-14 19:29 29,696 –a—— C:\WINNT\system32\2985352ld.exe
2006-11-14 19:08 29,696 –a—— C:\WINNT\system32\8135512ld.exe
2006-11-14 18:57 29,696 –a—— C:\WINNT\system32\57185702ld.exe
2006-11-14 18:51 127,208 –a—— C:\WINNT\system32\mucltui.dll
2006-11-14 18:36 29,696 –a—— C:\WINNT\system32\3652772ld.exe
2006-11-14 00:46 29,184 –a—— C:\WINNT\system32\46155532ld.exe
2006-11-14 00:26 29,184 –a—— C:\WINNT\system32\26121122ld.exe
2006-11-13 23:39 29,184 –a—— C:\WINNT\system32\3913322ld.exe
2006-11-13 23:19 29,184 –a—— C:\WINNT\system32\1979192ld.exe
2006-11-13 22:59 29,184 –a—— C:\WINNT\system32\5925362ld.exe
2006-11-13 22:38 29,184 –a—— C:\WINNT\system32\38589652ld.exe
2006-11-13 22:18 29,184 –a—— C:\WINNT\system32\18547532ld.exe
2006-11-13 21:37 29,184 –a—— C:\WINNT\system32\37469462ld.exe
2006-11-13 21:17 29,184 –a—— C:\WINNT\system32\17427042ld.exe
2006-11-13 20:57 29,184 –a—— C:\WINNT\system32\57379322ld.exe
2006-11-13 20:37 29,184 –a—— C:\WINNT\system32\3733802ld.exe
2006-11-13 20:17 29,184 –a—— C:\WINNT\system32\17205362ld.exe
2006-11-13 17:46 29,184 –a—— C:\WINNT\system32\4608942ld.exe
2006-11-13 17:29 29,184 –a—— C:\WINNT\system32\293082ld.exe
2006-11-13 17:09 29,184 –a—— C:\WINNT\system32\9255262ld.exe
2006-11-13 16:49 29,184 –a—— C:\WINNT\system32\49224962ld.exe
2006-11-13 12:52 29,184 –a—— C:\WINNT\system32\52105722ld.exe
2006-11-13 12:32 29,184 –a—— C:\WINNT\system32\3272312ld.exe
2006-11-13 12:12 29,184 –a—— C:\WINNT\system32\1235402ld.exe
2006-11-13 09:34 29,184 –a—— C:\WINNT\system32\3434132ld.exe
2006-11-12 00:58 2,585,872 –a—— C:\WindowsInstaller-KB893803-v2-x86.exe
2006-11-12 00:54 9,692,736 –a—— C:\nmsetup.exe
2006-11-09 02:27 51,072 –a—— C:\WINNT\system32\drivers\ikhlayer.sys
2006-11-09 02:27 30,592 –a—— C:\WINNT\system32\drivers\ikhfile.sys
2006-11-09 02:24 8,598,632 –a—— C:\WINNT\sdsetup.exe
2006-11-08 21:42 7,168 –a—— C:\WINNT\system32\wamregps.dll
2006-11-08 21:42 60,416 –a—— C:\WINNT\system32\iismap.dll
2006-11-08 21:42 59,392 –a—— C:\WINNT\system32\iisext.dll
2006-11-08 21:42 34,816 –a—— C:\WINNT\system32\admwprox.dll
2006-11-08 21:42 3,584 –a—— C:\WINNT\system32\iismui.dll
2006-11-08 21:42 19,968 –a—— C:\WINNT\system32\inetsloc.dll
2006-11-08 21:42 13,312 –a—— C:\WINNT\system32\exstrace.dll
2006-11-08 21:42 120,832 –a—— C:\WINNT\system32\iisRtl.dll
2006-11-08 21:42 11,776 –a—— C:\WINNT\system32\infoadmn.dll
2006-11-08 21:22 24,661 –a—— C:\WINNT\system32\spxcoins.dll
2006-11-08 21:22 13,312 –a—— C:\WINNT\system32\irclass.dll
2006-11-08 20:33 124,184 –a—— C:\WINNT\system32\wuauclt.exe
2006-11-08 20:33 1,343,768 –a—— C:\WINNT\system32\wuaueng.dll
2006-11-03 03:19 499,200 –a—— C:\WINNT\system32\comuid.dll
2006-11-03 03:19 150,528 –a—— C:\WINNT\system32\msdtcuiu.dll
2006-11-03 03:18 974,336 –a—— C:\WINNT\system32\msdtctm.dll
2006-11-03 03:18 368,640 –a—— C:\WINNT\system32\msdtcprx.dll
2006-11-03 03:18 110,080 –a—— C:\WINNT\system32\clbcatex.dll
2006-11-02 23:35 8,464 –a—— C:\WINNT\system32\sporder.dll
2006-11-02 01:51 7,680 ——— C:\WINNT\system32\bitsprx2.dll
2006-11-02 01:51 7,168 ——— C:\WINNT\system32\bitsprx3.dll
2006-11-02 01:51 17,408 –a—— C:\WINNT\system32\qmgrprxy.dll
2006-11-02 01:50 331,776 –a—— C:\WINNT\system32\winhttp.dll
2006-11-02 01:37 d——– C:\WINNT\McAfee.com
2006-11-01 13:37 1,259 –a—— C:\WINNT\system32\yum96b4e.sys
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
Rootkit driver pe386 is present. A rootkit scan is required
2006-11-20 23:04 ——– d——– C:\Documents and Settings\Tessa\Application Data\Azureus
2006-11-20 22:16 ——– d——– C:\Program Files\Grisoft
2006-11-20 16:21 ——– d-a—— C:\Program Files\Accessories
2006-11-20 16:21 ——– d——– C:\Program Files\PSDream
2006-11-20 15:03 ——– d——– C:\Documents and Settings\Tessa\Application Data\MSN6
2006-11-20 02:25 ——– d-a—— C:\Program Files\Common Files
2006-11-20 01:53 ——– d——– C:\Program Files\HJT
2006-11-18 22:22 9898 –a—— C:\Program Files\BBToolBar2.INI
2006-11-18 22:22 96 –a—— C:\Program Files\Default7BBC
2006-11-18 22:22 768 –a—— C:\Program Files\MySetup.DK
2006-11-18 22:22 46823 –a—— C:\Program Files\intrface.bbw
2006-11-18 22:22 3200 –a—— C:\Program Files\DEFAULT.ALI
2006-11-18 19:12 40 –a—— C:\Program Files\Tuner.cfg
2006-11-18 19:07 80 –a–c— C:\Program Files\BURN.TXT
2006-11-18 16:56 203 –a–c— C:\Program Files\BBWERROR.LOG
2006-11-17 09:05 ——– d——– C:\Program Files\Messenger
2006-11-16 04:45 ——– d——– C:\Program Files\TrojanHunter 4.2
2006-11-16 04:07 ——– d-a—— C:\Program Files\Windows Media Player
2006-11-16 03:24 ——– d-a—— C:\Program Files\Outlook Express
2006-11-16 03:24 ——– d-a—— C:\Program Files\Common Files\System
2006-11-14 21:58 ——– d-a—— C:\Program Files\Internet Explorer
2006-11-14 21:48 ——– d-a—— C:\Program Files\NetMeeting
2006-11-14 21:48 ——– d——– C:\Program Files\Movie Maker
2006-11-14 18:50 ——– d-ah—– C:\Program Files\WindowsUpdate
2006-11-13 22:17 ——– d——– C:\Program Files\Google
2006-11-11 22:48 ——– d——– C:\Documents and Settings\Tessa\Application Data\DriveCleaner 2006 Free
2006-11-09 04:31 ——– d—s—- C:\Documents and Settings\Tessa\Application Data\Microsoft
2006-11-09 04:28 ——– d——– C:\Program Files\SpywareBlaster
2006-11-09 04:19 ——– d——– C:\Program Files\Spyware Doctor
2006-11-09 02:43 ——– d——– C:\Documents and Settings\Tessa\Application Data\Google
2006-11-09 02:27 ——– d——– C:\Documents and Settings\Tessa\Application Data\PC Tools
2006-11-09 02:09 ——– d-a—— C:\Program Files\Common Files\Services
2006-11-07 20:24 ——– d——– C:\Program Files\Dantz
2006-11-07 20:21 ——– d-a—— C:\Program Files\Common Files\InstallShield
2006-11-06 01:13 48128 –ahs—- C:\Program Files\Thumbs.db
2006-11-05 23:43 ——– d——– C:\Program Files\WinRAR
2006-11-03 00:21 ——– d——– C:\Program Files\Creative
2006-11-02 23:12 ——– d——– C:\Program Files\Azureus
2006-11-02 01:16 ——– d——– C:\Program Files\Lavasoft
2006-11-02 01:16 ——– d——– C:\Documents and Settings\Tessa\Application Data\Lavasoft
2006-11-02 00:50 ——– d——– C:\Program Files\Common Files\iS3
2006-11-01 21:52 ——– d-a—— C:\Program Files\Common Files\Symantec Shared
2006-11-01 21:41 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-10-29 19:00 ——– d——– C:\Program Files\Sonic Foundry ACID Music
2006-10-28 15:37 ——– d——– C:\Program Files\QuickTime
2006-10-26 23:52 ——– d——– C:\Documents and Settings\Tessa\Application Data\Apple Computer
2006-10-13 23:07 ——– d——– C:\Documents and Settings\Tessa\Application Data\eFax Messenger
2006-10-11 08:18 ——– d——– C:\Program Files\Yahoo!
2006-10-07 15:20 192 –a—— C:\Program Files\$MIDIMON.cfg
2006-10-03 23:35 ——– d——– C:\Program Files\Citrix
2006-10-03 23:35 ——– d——– C:\Documents and Settings\Tessa\Application Data\ICAClient
2006-09-27 15:53 ——– d——– C:\Documents and Settings\Tessa\Application Data\Yahoo!
2006-09-27 07:36 ——– d——– C:\Documents and Settings\Tessa\Application Data\Image Zone Express
2006-09-27 07:35 ——– d——– C:\Program Files\DebugMode
2006-09-27 07:24 ——– d-a—— C:\Program Files\Adobe
2006-09-27 07:24 ——– d——– C:\Program Files\Sonic Foundry
2006-09-27 07:24 ——– d——– C:\Program Files\Pure Motion
2006-09-12 23:09 1110528 –a—— C:\WINNT\system32\msxml3.dll
2006-08-26 16:48 91098 –ah-c— C:\Program Files\bbw.GID
2006-08-26 13:31 16784 —–c— C:\Documents and Settings\Tessa\Application Data\GDIPFONTCACHEV1.DAT
2006-08-25 09:53 561664 –a—— C:\WINNT\system32\comctl32.dll
2006-08-25 03:14 595968 –a—— C:\WINNT\system32\xpsp2res.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"MSMSGS"="\"C:\\Program Files\\Messenger\\MSMSGS.EXE\" /background"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"POINTER"="point32.exe"
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"THGuard"="\"C:\\Program Files\\TrojanHunter 4.2\\THGuard.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"msconfig"="C:\\WINNT\\scvhost.exe"
"Update Checker"="C:\\WINNT\\scvhost.exe"
@="C:\\WINNT\\scvhost.exe"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00000000
"Position"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,dc,00,00,00,d0,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,01,00,00,00
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="C:\\Program Files\\Common Files\\mehe.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\Backup.job
C:\WINNT\tasks\Disk Cleanup.job
C:\WINNT\tasks\Symantec NetDetect.job
Completion time: 06-11-20 23:05:59.04
C:\ComboFix.txt … 06-11-20 23:05
C:\ComboFix2.txt … 06-11-18 12:14
C:\ComboFix3.txt … 06-11-18 11:32
Logfile of HijackThis v1.99.1
Scan saved at 11:09:17 PM, on 11/20/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Azureus\Azureus.exe
C:\WINNT\System32\ping.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
Your HJT log was cut off.
Also I need the - AVG Anti-Rootkit report
Please post it after doing the below fix.
Download Pocket Killbox
http://www.atribune.org/downloads/KillBox.exe
If you already have Killbox first ensure it is this version !.
Then double-click on the killbox.exe program.
Start Killbox and click on Tools->Delete Temp Files.
Then select the option labeled
Delete on reboot.
Do not close killbox, and open
notepad , by clicking on Start, then Run, and typing notepad.exe and pressing the OK button.
When notepad is open,
copy and paste the following
bolded text into the notepad screen. You do this by highlighting each of the below bolded filenames and then pressing
Control-C on your keyboard. Then click on the open notepad windows and press
Control-V to paste the contents into the notepad.
C:\WINNT\system32\167982ld.exe
C:\WINNT\system32\53432732ld.exe
C:\WINNT\system32\32547982ld.exe
C:\WINNT\system32\12298362ld.exe
C:\WINNT\system32\28306052ld.exe
C:\WINNT\system32\886072ld.exe
C:\WINNT\system32\41219972ld.exe
C:\WINNT\system32\tmp_2k4.exe
C:\WINNT\system32\412192ld.exe
C:\WINNT\system32\3102792ld.exe
C:\WINNT\system32\24545722ld.exe
C:\WINNT\system32\3555922ld.exe
C:\WINNT\system32\43131452ld.exe
C:\WINNT\system32\2212222ld.exe
C:\WINNT\system32\21201142ld.exe
C:\WINNT\system32\0224152ld.exe
C:\WINNT\system32\39361832ld.exe
C:\WINNT\system32\1984282ld.exe
C:\WINNT\system32\5841132ld.exe
C:\WINNT\system32\38196372ld.exe
C:\WINNT\system32\17448212ld.exe
C:\WINNT\system32\5713132ld.exe
C:\WINNT\system32\1107362ld.exe
C:\WINNT\system32\40468662ld.exe
C:\WINNT\system32\19482062ld.exe
C:\WINNT\system32\59286322ld.exe
C:\WINNT\system32\38348792ld.exe
C:\WINNT\system32\17385532ld.exe
C:\WINNT\system32\56492772ld.exe
C:\WINNT\system32\37114812ld.exe
C:\WINNT\system32\1715712ld.exe
C:\WINNT\system32\5494852ld.exe
C:\WINNT\system32\4541852ld.exe
C:\WINNT\system32\22231992ld.exe
C:\WINNT\system32\36423522ld.exe
C:\WINNT\system32\15458552ld.exe
C:\WINNT\system32\54599532ld.exe
C:\WINNT\system32\46505802ld.exe
C:\WINNT\system32\58144492ld.exe
C:\WINNT\system32\ipv6monl.dll
C:\WINNT\system32\37133662ld.exe
C:\WINNT\system32\43524502ld.exe
C:\WINNT\system32\22528182ld.exe
C:\WINNT\system32\1493122ld.exe
C:\WINNT\system32\4045242ld.exe
C:\WINNT\system32\18337092ld.exe
C:\WINNT\system32\56385582ld.exe
C:\WINNT\system32\53532512ld.exe
C:\WINNT\system32\31547052ld.exe
C:\WINNT\system32\19346342ld.exe
C:\WINNT\system32\5925132ld.exe
C:\WINNT\system32\31252662ld.exe
C:\WINNT\system32\922052ld.exe
C:\WINNT\system32\6222652ld.exe
C:\WINNT\system32\3577872ld.exe
C:\WINNT\system32\1354432ld.exe
C:\WINNT\system32\59306032ld.exe
C:\WINNT\system32\57282472ld.exe
C:\WINNT\system32\54536052ld.exe
C:\WINNT\system32\33523612ld.exe
C:\WINNT\system32\setup.exe
C:\WINNT\system32\57484702ld.exe
C:\WINNT\system32\36532452ld.exe
C:\WINNT\system32\30377002ld.exe
C:\WINNT\system32\10107562ld.exe
C:\WINNT\system32\49432912ld.exe
C:\WINNT\system32\2985352ld.exe
C:\WINNT\system32\8135512ld.exe
C:\WINNT\system32\57185702ld.exe
C:\WINNT\system32\3652772ld.exe
C:\WINNT\system32\46155532ld.exe
C:\WINNT\system32\26121122ld.exe
C:\WINNT\system32\3913322ld.exe
C:\WINNT\system32\1979192ld.exe
C:\WINNT\system32\5925362ld.exe
C:\WINNT\system32\38589652ld.exe
C:\WINNT\system32\18547532ld.exe
C:\WINNT\system32\37469462ld.exe
C:\WINNT\system32\17427042ld.exe
C:\WINNT\system32\57379322ld.exe
C:\WINNT\system32\3733802ld.exe
C:\WINNT\system32\17205362ld.exe
C:\WINNT\system32\4608942ld.exe
C:\WINNT\system32\293082ld.exe
C:\WINNT\system32\9255262ld.exe
C:\WINNT\system32\49224962ld.exe
C:\WINNT\system32\52105722ld.exe
C:\WINNT\system32\3272312ld.exe
C:\WINNT\system32\1235402ld.exe
C:\WINNT\system32\3434132ld.exe
C:\WINNT\system32\yum96b4e.sys
C:\WINNT\scvhost.exe
Return to Killbox, go to the File menu and select
Paste from Clipboard.
Still in Killbox, click the
red-and-white Delete File button. Click
Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually
"copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Here's the new info:
Logfile of HijackThis v1.99.1
Scan saved at 9:55:48 PM, on 11/21/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
F:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) -
http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
AVG Anti-Rootkit report:
C:\WINNT\System32:lzx32.sys Hidden driver file
The computer is still running well!!!!
That rookit might still be there.
Please run a new Combofix
here's the new combo fix log:
Tessa - 06-11-22 13:02:39.40 Service Pack 1
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Tessa\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2006-10-22 to 2006-11-22 ))))))))))))))))))))))))))))))))))
2006-11-18 16:23 3,968 –a—— C:\WINNT\system32\drivers\AvgAsCln.sys
2006-11-17 21:53 29,696 –a—— C:\WINNT\system32\53432732ld.exe
2006-11-17 21:32 29,696 –a—— C:\WINNT\system32\32547982ld.exe
2006-11-17 21:12 29,696 –a—— C:\WINNT\system32\12298362ld.exe
2006-11-17 19:28 29,696 –a—— C:\WINNT\system32\28306052ld.exe
2006-11-17 19:08 29,696 –a—— C:\WINNT\system32\886072ld.exe
2006-11-17 18:41 29,696 –a—— C:\WINNT\system32\41219972ld.exe
2006-11-17 18:41 10,609 -r-h—– C:\WINNT\system32\tmp_2k4.exe
2006-11-17 18:41 10,609 –a—— C:\WINNT\system32\412192ld.exe
2006-11-17 18:03 29,696 –a—— C:\WINNT\system32\3102792ld.exe
2006-11-17 10:24 29,696 –a—— C:\WINNT\system32\24545722ld.exe
2006-11-17 10:03 29,696 –a—— C:\WINNT\system32\3555922ld.exe
2006-11-17 09:43 29,696 –a—— C:\WINNT\system32\43131452ld.exe
2006-11-17 09:22 29,696 –a—— C:\WINNT\system32\2212222ld.exe
2006-11-17 07:21 29,696 –a—— C:\WINNT\system32\21201142ld.exe
2006-11-17 07:00 29,696 –a—— C:\WINNT\system32\0224152ld.exe
2006-11-17 06:39 29,696 –a—— C:\WINNT\system32\39361832ld.exe
2006-11-17 06:19 29,696 –a—— C:\WINNT\system32\1984282ld.exe
2006-11-17 05:58 29,696 –a—— C:\WINNT\system32\5841132ld.exe
2006-11-17 05:38 29,696 –a—— C:\WINNT\system32\38196372ld.exe
2006-11-17 05:17 29,696 –a—— C:\WINNT\system32\17448212ld.exe
2006-11-17 04:57 29,696 –a—— C:\WINNT\system32\5713132ld.exe
2006-11-17 01:01 29,696 –a—— C:\WINNT\system32\1107362ld.exe
2006-11-17 00:40 29,696 –a—— C:\WINNT\system32\40468662ld.exe
2006-11-17 00:19 29,696 –a—— C:\WINNT\system32\19482062ld.exe
2006-11-16 23:59 29,696 –a—— C:\WINNT\system32\59286322ld.exe
2006-11-16 23:38 29,696 –a—— C:\WINNT\system32\38348792ld.exe
2006-11-16 23:17 29,696 –a—— C:\WINNT\system32\17385532ld.exe
2006-11-16 22:56 29,696 –a—— C:\WINNT\system32\56492772ld.exe
2006-11-16 22:37 29,696 –a—— C:\WINNT\system32\37114812ld.exe
2006-11-16 22:17 29,696 –a—— C:\WINNT\system32\1715712ld.exe
2006-11-16 22:11 47,104 –a—— C:\ATF-Cleaner.exe
2006-11-16 22:05 29,696 –a—— C:\WINNT\system32\5494852ld.exe
2006-11-16 21:45 29,696 –a—— C:\WINNT\system32\4541852ld.exe
2006-11-16 21:22 29,696 –a—— C:\WINNT\system32\22231992ld.exe
2006-11-16 10:36 29,696 –a—— C:\WINNT\system32\36423522ld.exe
2006-11-16 10:15 29,696 –a—— C:\WINNT\system32\15458552ld.exe
2006-11-16 09:55 29,696 –a—— C:\WINNT\system32\54599532ld.exe
2006-11-16 03:46 29,696 –a—— C:\WINNT\system32\46505802ld.exe
2006-11-16 02:58 29,696 –a—— C:\WINNT\system32\58144492ld.exe
2006-11-16 02:43 98,008 –a—— C:\WINNT\system32\ipv6monl.dll
2006-11-16 02:37 29,696 –a—— C:\WINNT\system32\37133662ld.exe
2006-11-15 23:43 29,696 –a—— C:\WINNT\system32\43524502ld.exe
2006-11-15 23:22 29,696 –a—— C:\WINNT\system32\22528182ld.exe
2006-11-15 23:01 29,696 –a—— C:\WINNT\system32\1493122ld.exe
2006-11-15 22:40 29,696 –a—— C:\WINNT\system32\4045242ld.exe
2006-11-15 22:18 29,696 –a—— C:\WINNT\system32\18337092ld.exe
2006-11-15 21:56 29,696 –a—— C:\WINNT\system32\56385582ld.exe
2006-11-15 21:53 29,696 –a—— C:\WINNT\system32\53532512ld.exe
2006-11-15 21:31 29,696 –a—— C:\WINNT\system32\31547052ld.exe
2006-11-15 21:26 991,232 –a—— C:\WINNT\system32\esent.dll
2006-11-15 17:19 29,696 –a—— C:\WINNT\system32\19346342ld.exe
2006-11-15 16:59 29,696 –a—— C:\WINNT\system32\5925132ld.exe
2006-11-15 14:31 29,696 –a—— C:\WINNT\system32\31252662ld.exe
2006-11-15 14:09 29,696 –a—— C:\WINNT\system32\922052ld.exe
2006-11-15 14:06 29,696 –a—— C:\WINNT\system32\6222652ld.exe
2006-11-15 14:03 29,696 –a—— C:\WINNT\system32\3577872ld.exe
2006-11-15 14:01 29,696 –a—— C:\WINNT\system32\1354432ld.exe
2006-11-15 13:59 29,696 –a—— C:\WINNT\system32\59306032ld.exe
2006-11-15 13:57 29,696 –a—— C:\WINNT\system32\57282472ld.exe
2006-11-15 13:54 29,696 –a—— C:\WINNT\system32\54536052ld.exe
2006-11-15 13:33 29,696 –a—— C:\WINNT\system32\33523612ld.exe
2006-11-14 21:38 98,304 –a—— C:\WINNT\system32\oleprn.dll
2006-11-14 21:38 94,208 –a—— C:\WINNT\system32\odbccp32.dll
2006-11-14 21:38 91,136 –a—— C:\WINNT\system32\rastls.dll
2006-11-14 21:38 9,216 –a—— C:\WINNT\system32\wuauserv.dll
2006-11-14 21:38 891,711 ——— C:\WINNT\system32\drivers\nv4_mini.sys
2006-11-14 21:38 88,064 –a—— C:\WINNT\system32\tscfgwmi.dll
2006-11-14 21:38 87,304 –a—— C:\WINNT\system32\rdpdd.dll
2006-11-14 21:38 86,528 –a—— C:\WINNT\system32\wlnotify.dll
2006-11-14 21:38 86,016 –a—— C:\WINNT\system32\xactsrv.dll
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\smlogsvc.exe
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\psbase.dll
2006-11-14 21:38 81,920 –a—— C:\WINNT\system32\trkwks.dll
2006-11-14 21:38 8,192 –a—— C:\WINNT\system32\scrnsave.scr
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpstub.exe
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpshell.dll
2006-11-14 21:38 75,912 –a—— C:\WINNT\system32\rdpwsx.dll
2006-11-14 21:38 74,240 –a—— C:\WINNT\system32\rtcshare.exe
2006-11-14 21:38 72,192 –a—— C:\WINNT\system32\telnet.exe
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\storprop.dll
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\sdbinst.exe
2006-11-14 21:38 686,080 –a—— C:\WINNT\system32\opengl32.dll
2006-11-14 21:38 667,648 –a—— C:\WINNT\system32\ss3dfo.scr
2006-11-14 21:38 66,560 –a—— C:\WINNT\system32\spoolss.dll
2006-11-14 21:38 66,048 –a—— C:\WINNT\system32\sigverif.exe
2006-11-14 21:38 638,976 –a—— C:\WINNT\system32\sstext3d.scr
2006-11-14 21:38 63,488 –a—— C:\WINNT\system32\srclient.dll
2006-11-14 21:38 62,976 –a—— C:\WINNT\system32\shgina.dll
2006-11-14 21:38 61,952 –a—— C:\WINNT\system32\sti.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccu32.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccr32.dll
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\wextract.exe
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\shimeng.dll
2006-11-14 21:38 6,144 –a—— C:\WINNT\system32\sensapi.dll
2006-11-14 21:38 58,880 –a—— C:\WINNT\system32\pautoenr.dll
2006-11-14 21:38 57,856 –a—— C:\WINNT\system32\raschap.dll
2006-11-14 21:38 569,344 –a—— C:\WINNT\system32\sspipes.scr
2006-11-14 21:38 56,832 –a—— C:\WINNT\system32\wzcdlg.dll
2006-11-14 21:38 56,320 –a—— C:\WINNT\system32\remotepg.dll
2006-11-14 21:38 548,864 –a—— C:\WINNT\system32\rtcdll.dll
2006-11-14 21:38 534,016 –a—— C:\WINNT\system32\spider.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\packager.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\odbcconf.exe
2006-11-14 21:38 52,224 –a—— C:\WINNT\system32\secur32.dll
2006-11-14 21:38 511,488 –a—— C:\WINNT\system32\qedit.dll
2006-11-14 21:38 51,200 –a—— C:\WINNT\system32\wmerrenu.dll
2006-11-14 21:38 5,504 ——— C:\WINNT\system32\drivers\smbali.sys
2006-11-14 21:38 48,640 –a—— C:\WINNT\system32\vdmredir.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\winsta.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\reg.exe
2006-11-14 21:38 479,261 –a—— C:\WINNT\system32\vbscript.dll
2006-11-14 21:38 47,616 –a—— C:\WINNT\system32\utilman.exe
2006-11-14 21:38 446,464 –a—— C:\WINNT\system32\wmvdmoe.dll
2006-11-14 21:38 442,398 –a—— C:\WINNT\system32\wmadmoe.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\regapi.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\rdpclip.exe
2006-11-14 21:38 43,008 –a—— C:\WINNT\system32\ssdpsrv.dll
2006-11-14 21:38 423,424 –a—— C:\WINNT\system32\riched20.dll
2006-11-14 21:38 420,864 –a—— C:\WINNT\system32\shimgvw.dll
2006-11-14 21:38 409,088 –a—— C:\WINNT\system32\vssapi.dll
2006-11-14 21:38 40,960 –a—— C:\WINNT\system32\tscupgrd.exe
2006-11-14 21:38 392,704 –a—— C:\WINNT\system32\ntmssvc.dll
2006-11-14 21:38 385,024 –a—— C:\WINNT\system32\sqlsrv32.dll
2006-11-14 21:38 384,000 –a—— C:\WINNT\system32\themeui.dll
2006-11-14 21:38 38,912 –a—— C:\WINNT\system32\wsnmp32.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntmsapi.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntlanman.dll
2006-11-14 21:38 364,544 –a—— C:\WINNT\system32\ssflwbox.scr
2006-11-14 21:38 36,352 –a—— C:\WINNT\system32\sens.dll
2006-11-14 21:38 357,376 –a—— C:\WINNT\system32\qdvd.dll
2006-11-14 21:38 34,304 –a—— C:\WINNT\system32\rcimlby.exe
2006-11-14 21:38 339,456 –a—— C:\WINNT\system32\usp10.dll
2006-11-14 21:38 334,848 –a—— C:\WINNT\system32\smlogcfg.dll
2006-11-14 21:38 33,280 –a—— C:\WINNT\system32\shmgrate.exe
2006-11-14 21:38 32,768 –a—— C:\WINNT\system32\odbcad32.exe
2006-11-14 21:38 32,256 –a—— C:\WINNT\system32\umandlg.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\zipfldr.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\wiaservc.dll
2006-11-14 21:38 311,327 –a—— C:\WINNT\system32\wmv8dmod.dll
2006-11-14 21:38 31,744 –a—— C:\WINNT\system32\pid.dll
2006-11-14 21:38 3,494,303 ——— C:\WINNT\system32\nv4_disp.dll
2006-11-14 21:38 3,338 –a—— C:\WINNT\system32\redir.exe
2006-11-14 21:38 297,984 –a—— C:\WINNT\system32\scesrv.dll
2006-11-14 21:38 296,448 –a—— C:\WINNT\system32\wmstream.dll
2006-11-14 21:38 294,912 –a—— C:\WINNT\system32\wmvdmod.dll
2006-11-14 21:38 274,432 –a—— C:\WINNT\system32\wmasf.dll
2006-11-14 21:38 27,136 –a—— C:\WINNT\system32\ssdpapi.dll
2006-11-14 21:38 266,752 –a—— C:\WINNT\winhlp32.exe
2006-11-14 21:38 264,704 –a—— C:\WINNT\system32\wzcsvc.dll
2006-11-14 21:38 258,048 –a—— C:\WINNT\system32\webcheck.dll
2006-11-14 21:38 254,976 –a—— C:\WINNT\system32\pdh.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmpcd.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmnetmgr.dll
2006-11-14 21:38 251,904 –a—— C:\WINNT\system32\strmdll.dll
2006-11-14 21:38 247,808 –a—— C:\WINNT\system32\wow32.dll
2006-11-14 21:38 24,576 –a—— C:\WINNT\system32\odbcbcp.dll
2006-11-14 21:38 24,064 –a—— C:\WINNT\system32\skeys.exe
2006-11-14 21:38 231,424 –a—— C:\WINNT\system32\upnpui.dll
2006-11-14 21:38 23,552 –a—— C:\WINNT\system32\wzcsapi.dll
2006-11-14 21:38 226,816 –a—— C:\WINNT\system32\srrstr.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\slayerxp.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\shfolder.dll
2006-11-14 21:38 22,016 –a—— C:\WINNT\system32\udhisapi.dll
2006-11-14 21:38 212,480 –a—— C:\WINNT\system32\osk.exe
2006-11-14 21:38 203,264 –a—— C:\WINNT\system32\uxtheme.dll
2006-11-14 21:38 200,704 –a—— C:\WINNT\system32\odbc32.dll
2006-11-14 21:38 200,192 –a—— C:\WINNT\system32\termsrv.dll
2006-11-14 21:38 20,992 –a—— C:\WINNT\system32\setup.exe
2006-11-14 21:38 193,536 –a—— C:\WINNT\system32\rasppp.dll
2006-11-14 21:38 19,456 –a—— C:\WINNT\system32\ssmarque.scr
2006-11-14 21:38 184,832 –a—— C:\WINNT\system32\qcap.dll
2006-11-14 21:38 184,320 –a—— C:\WINNT\system32\wmadmod.dll
2006-11-14 21:38 18,944 –a—— C:\WINNT\system32\ssbezier.scr
2006-11-14 21:38 174,592 –a—— C:\WINNT\system32\scecli.dll
2006-11-14 21:38 172,664 –a—— C:\WINNT\system32\xenroll.dll
2006-11-14 21:38 171,520 –a—— C:\WINNT\system32\winmm.dll
2006-11-14 21:38 171,008 –a—— C:\WINNT\system32\sccsccp.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\wtsapi32.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\ssmyst.scr
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\psapi.dll
2006-11-14 21:38 169,984 –a—— C:\WINNT\system32\sccbase.dll
2006-11-14 21:38 168,448 –a—— C:\WINNT\system32\wldap32.dll
2006-11-14 21:38 165,888 –a—— C:\WINNT\system32\ntmsdba.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\w32time.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\tapi32.dll
2006-11-14 21:38 164,864 –a—— C:\WINNT\system32\upnphost.dll
2006-11-14 21:38 16,896 –a—— C:\WINNT\system32\snmpapi.dll
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\watchdog.sys
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ups.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ping.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\odbc32gt.dll
2006-11-14 21:38 159,232 –a—— C:\WINNT\system32\schedsvc.dll
2006-11-14 21:38 158,720 –a—— C:\WINNT\system32\srsvc.dll
2006-11-14 21:38 147,456 –a—— C:\WINNT\system32\odbctrac.dll
2006-11-14 21:38 14,848 –a—— C:\WINNT\system32\rdpsnd.dll
2006-11-14 21:38 137,216 –a—— C:\WINNT\system32\ntshrui.dll
2006-11-14 21:38 135,680 –a—— C:\WINNT\system32\rdchost.dll
2006-11-14 21:38 134,144 –a—— C:\WINNT\regedit.exe
2006-11-14 21:38 133,632 –a—— C:\WINNT\system32\rsaenh.dll
2006-11-14 21:38 133,120 –a—— C:\WINNT\system32\sfc_os.dll
2006-11-14 21:38 130,560 –a—— C:\WINNT\system32\sti_ci.dll
2006-11-14 21:38 13,824 –a—— C:\WINNT\system32\rassapi.dll
2006-11-14 21:38 13,312 –a—— C:\WINNT\system32\ssstars.scr
2006-11-14 21:38 128,512 –a—— C:\WINNT\system32\taskmgr.exe
2006-11-14 21:38 124,928 –a—— C:\WINNT\system32\webvw.dll
2006-11-14 21:38 122,880 –a—— C:\WINNT\system32\odbcconf.dll
2006-11-14 21:38 120,320 –a—— C:\WINNT\system32\upnp.dll
2006-11-14 21:38 12,800 –a—— C:\WINNT\system32\runonce.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\rdsaddin.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\odbcp32r.dll
2006-11-14 21:38 119,808 –a—— C:\WINNT\system32\wiadss.dll
2006-11-14 21:38 118,784 –a—— C:\WINNT\system32\wmsdmoe.dll
2006-11-14 21:38 117,760 –a—— C:\WINNT\system32\stobject.dll
2006-11-14 21:38 112,128 –a—— C:\WINNT\system32\ntmarta.dll
2006-11-14 21:38 110,592 –a—— C:\WINNT\system32\wmsdmod.dll
2006-11-14 21:38 11,776 –a—— C:\WINNT\system32\sigtab.dll
2006-11-14 21:38 109,568 –a—— C:\WINNT\system32\offfilt.dll
2006-11-14 21:38 106,496 –a—— C:\WINNT\system32\url.dll
2006-11-14 21:38 10,752 –a—— C:\WINNT\system32\tracert.exe
2006-11-14 21:38 10,752 –a—— C:\WINNT\hh.exe
2006-11-14 21:38 1,998,848 –a—— C:\WINNT\system32\wmploc.dll
2006-11-14 21:38 1,350,144 –a—— C:\WINNT\system32\query.dll
2006-11-14 21:38 1,298,432 –a—— C:\WINNT\system32\wmpcore.dll
2006-11-14 21:38 1,220,608 –a—— C:\WINNT\system32\wmvcore.dll
2006-11-14 21:38 1,157,632 –a—— C:\WINNT\system32\sfcfiles.dll
2006-11-14 21:37 95,744 –a—— C:\WINNT\system32\nlhtml.dll
2006-11-14 21:37 921,475 ——— C:\WINNT\system32\ati3d2ag.dll
2006-11-14 21:37 91,136 –a—— C:\WINNT\system32\MSOERT2.DLL
2006-11-14 21:37 9,728 –a—— C:\WINNT\system32\mstinit.exe
2006-11-14 21:37 857,600 –a—— C:\WINNT\system32\netplwiz.dll
2006-11-14 21:37 844,675 ——— C:\WINNT\system32\ati3d1ag.dll
2006-11-14 21:37 699,392 –a—— C:\WINNT\system32\msxml2.dll
2006-11-14 21:37 68,608 –a—— C:\WINNT\system32\mscms.dll
2006-11-14 21:37 67,584 –a—— C:\WINNT\system32\msctfp.dll
2006-11-14 21:37 65,536 –a—— C:\WINNT\system32\msconf.dll
2006-11-14 21:37 63,663 –a—— C:\WINNT\system32\drivers\atinrvxx.sys
2006-11-14 21:37 6,912 ——— C:\WINNT\system32\drivers\hidir.sys
2006-11-14 21:37 6,656 –a—— C:\WINNT\system32\laprxy.dll
2006-11-14 21:37 598,016 –a—— C:\WINNT\system32\mstscax.dll
2006-11-14 21:37 584,192 –a—— C:\WINNT\system32\netcfgx.dll
2006-11-14 21:37 57,856 –a—— C:\WINNT\system32\licwmi.dll
2006-11-14 21:37 56,591 –a—— C:\WINNT\system32\drivers\atinbtxx.sys
2006-11-14 21:37 56,320 –a—— C:\WINNT\system32\mshtmler.dll
2006-11-14 21:37 552,991 –a—— C:\WINNT\system32\msrepl40.dll
2006-11-14 21:37 512,031 –a—— C:\WINNT\system32\msexch40.dll
2006-11-14 21:37 504,832 ——— C:\WINNT\system32\msftedit.dll
2006-11-14 21:37 504,320 –a—— C:\WINNT\system32\logonui.exe
2006-11-14 21:37 5,120 ——— C:\WINNT\system32\hccoin.dll
2006-11-14 21:37 49,152 –a—— C:\WINNT\system32\npptools.dll
2006-11-14 21:37 450,176 ——— C:\WINNT\system32\drivers\ati2mtag.sys
2006-11-14 21:37 421,919 –a—— C:\WINNT\system32\msrd2x40.dll
2006-11-14 21:37 42,496 –a—— C:\WINNT\system32\ncobjapi.dll
2006-11-14 21:37 403,456 ——— C:\WINNT\system32\winbrand.dll
2006-11-14 21:37 401,462 –a—— C:\WINNT\system32\msvcp60.dll
2006-11-14 21:37 4,608 –a—— C:\WINNT\system32\msimg32.dll
2006-11-14 21:37 4,126 –a—— C:\WINNT\system32\msdxmlc.dll
2006-11-14 21:37 399,360 –a—— C:\WINNT\system32\netlogon.dll
2006-11-14 21:37 39,424 –a—— C:\WINNT\system32\net.exe
2006-11-14 21:37 388,608 –a—— C:\WINNT\system32\mstsc.exe
2006-11-14 21:37 381,440 –a—— C:\WINNT\system32\lmrt.dll
2006-11-14 21:37 377,984 –a—— C:\WINNT\system32\ati2dvaa.dll
2006-11-14 21:37 368,710 –a—— C:\WINNT\system32\msisam11.dll
2006-11-14 21:37 36,463 –a—— C:\WINNT\system32\drivers\atintuxx.sys
2006-11-14 21:37 348,195 –a—— C:\WINNT\system32\msjetoledb40.dll
2006-11-14 21:37 348,191 –a—— C:\WINNT\system32\mspbde40.dll
2006-11-14 21:37 344,095 –a—— C:\WINNT\system32\msxbde40.dll
2006-11-14 21:37 34,735 –a—— C:\WINNT\system32\drivers\atinxsxx.sys
2006-11-14 21:37 339,968 –a—— C:\WINNT\system32\mspaint.exe
2006-11-14 21:37 33,808 –a—— C:\WINNT\system32\ntio.sys
2006-11-14 21:37 327,040 –a—— C:\WINNT\system32\drivers\ati2mtaa.sys
2006-11-14 21:37 326,656 –a—— C:\WINNT\system32\netsetup.exe
2006-11-14 21:37 323,072 –a—— C:\WINNT\system32\msvcrt.dll
2006-11-14 21:37 32,256 –a—— C:\WINNT\system32\mnmdd.dll
2006-11-14 21:37 319,760 –a—— C:\WINNT\system32\msnsspc.dll
2006-11-14 21:37 319,519 –a—— C:\WINNT\system32\msexcl40.dll
2006-11-14 21:37 30,671 –a—— C:\WINNT\system32\drivers\atinraxx.sys
2006-11-14 21:37 3,584 ——— C:\WINNT\system32\dsprpres.dll
2006-11-14 21:37 29,455 –a—— C:\WINNT\system32\drivers\atinxbxx.sys
2006-11-14 21:37 266,752 –a—— C:\WINNT\system32\msctf.dll
2006-11-14 21:37 26,367 –a—— C:\WINNT\system32\drivers\atinsnxx.sys
2006-11-14 21:37 253,983 –a—— C:\WINNT\system32\mstext40.dll
2006-11-14 21:37 250,368 –a—— C:\WINNT\system32\mstask.dll
2006-11-14 21:37 241,725 –a—— C:\WINNT\system32\msuni11.dll
2006-11-14 21:37 241,695 –a—— C:\WINNT\system32\msjtes40.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\nmmkcert.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\logagent.exe
2006-11-14 21:37 238,080 –a—— C:\WINNT\system32\newdev.dll
2006-11-14 21:37 233,472 –a—— C:\WINNT\system32\mpg4dmod.dll
2006-11-14 21:37 230,400 –a—— C:\WINNT\system32\msieftp.dll
2006-11-14 21:37 229,376 –a—— C:\WINNT\system32\MSOEACCT.DLL
2006-11-14 21:37 22,528 –a—— C:\WINNT\system32\mslbui.dll
2006-11-14 21:37 219,648 –a—— C:\WINNT\system32\logon.scr
2006-11-14 21:37 218,112 ——— C:\WINNT\system32\sbe.dll
2006-11-14 21:37 213,023 –a—— C:\WINNT\system32\msltus40.dll
2006-11-14 21:37 210,944 –a—— C:\WINNT\system32\moricons.dll
2006-11-14 21:37 21,343 ——— C:\WINNT\system32\drivers\atinttxx.sys
2006-11-14 21:37 202,496 ——— C:\WINNT\system32\ati2dvag.dll
2006-11-14 21:37 196,096 –a—— C:\WINNT\system32\mobsync.dll
2006-11-14 21:37 192,512 –a—— C:\WINNT\system32\mswebdvd.dll
2006-11-14 21:37 19,456 –a—— C:\WINNT\system32\licmgr10.dll
2006-11-14 21:37 19,328 ——— C:\WINNT\system32\drivers\usbehci.sys
2006-11-14 21:37 187,904 ——— C:\WINNT\system32\xpsp1res.dll
2006-11-14 21:37 182,784 –a—— C:\WINNT\system32\msutb.dll
2006-11-14 21:37 18,944 ——— C:\WINNT\system32\faxpatch.exe
2006-11-14 21:37 174,592 –a—— C:\WINNT\system32\msnetobj.dll
2006-11-14 21:37 172,032 ——— C:\WINNT\system32\mssap.dll
2006-11-14 21:37 163,840 –a—— C:\WINNT\system32\mindex.dll
2006-11-14 21:37 16,384 –a—— C:\WINNT\system32\nddenb32.dll
2006-11-14 21:37 155,648 ——— C:\WINNT\system32\encdec.dll
2006-11-14 21:37 143,872 –a—— C:\WINNT\system32\msimtf.dll
2006-11-14 21:37 131,072 –a—— C:\WINNT\system32\msorcl32.dll
2006-11-14 21:37 13,056 ——— C:\WINNT\system32\drivers\wacompen.sys
2006-11-14 21:37 126,976 –a—— C:\WINNT\system32\msdart.dll
2006-11-14 21:37 12,288 –a—— C:\WINNT\system32\mscpx32r.dll
2006-11-14 21:37 12,288 ——— C:\WINNT\system32\encapi.dll
2006-11-14 21:37 12,047 ——— C:\WINNT\system32\drivers\atinpdxx.sys
2006-11-14 21:37 116,736 –a—— C:\WINNT\system32\mplay32.exe
2006-11-14 21:37 115,200 –a—— C:\WINNT\system32\net1.exe
2006-11-14 21:37 113,664 –a—— C:\WINNT\system32\msvfw32.dll
2006-11-14 21:37 110,080 ——— C:\WINNT\system32\sbeio.dll
2006-11-14 21:37 11,904 ——— C:\WINNT\system32\drivers\mutohpen.sys
2006-11-14 21:37 11,615 –a—— C:\WINNT\system32\drivers\atinmdxx.sys
2006-11-14 21:37 105,984 –a—— C:\WINNT\system32\netdde.exe
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\msrle32.dll
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\localui.dll
2006-11-14 21:37 1,677,312 ——— C:\WINNT\system32\wmvcore2.dll
2006-11-14 21:37 1,622,528 –a—— C:\WINNT\system32\netshell.dll
2006-11-14 21:37 1,503,262 –a—— C:\WINNT\system32\msjet40.dll
2006-11-14 21:37 1,220,608 –a—— C:\WINNT\system32\msvidctl.dll
2006-11-14 21:37 1,128,960 –a—— C:\WINNT\system32\mmcndmgr.dll
2006-11-14 21:36 98,816 –a—— C:\WINNT\system32\clipbrd.exe
2006-11-14 21:36 94,720 –a—— C:\WINNT\system32\dmusic.dll
2006-11-14 21:36 91,648 –a—— C:\WINNT\system32\iuctl.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\icaapi.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\dumprep.exe
2006-11-14 21:36 88,576 –a—— C:\WINNT\system32\mqsec.dll
2006-11-14 21:36 802,304 –a—— C:\WINNT\system32\dxmrtp.dll
2006-11-14 21:36 8,832 –a—— C:\WINNT\system32\framebuf.dll
2006-11-14 21:36 786,432 –a—— C:\WINNT\system32\dxdiag.exe
2006-11-14 21:36 77,312 –a—— C:\WINNT\system32\dmscript.dll
2006-11-14 21:36 76,830 –a—— C:\WINNT\system32\drmstor.dll
2006-11-14 21:36 76,288 –a—— C:\WINNT\system32\dfrgfat.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\tlntsess.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\ils.dll
2006-11-14 21:36 70,656 –a—— C:\WINNT\system32\defrag.exe
2006-11-14 21:36 70,144 –a—— C:\WINNT\system32\cryptdlg.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\tlntsvrp.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\fxsperf.dll
2006-11-14 21:36 7,040 –a—— C:\WINNT\system32\kd1394.dll
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\tlntsvr.exe
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\fdeploy.dll
2006-11-14 21:36 67,456 –a—— C:\WINNT\system32\drivers\mqac.sys
2006-11-14 21:36 66,560 –a—— C:\WINNT\system32\faultrep.dll
2006-11-14 21:36 61,440 –a—— C:\WINNT\system32\dbnetlib.dll
2006-11-14 21:36 608,768 –a—— C:\WINNT\system32\mqqm.dll
2006-11-14 21:36 602,112 –a—— C:\WINNT\system32\drmv2clt.dll
2006-11-14 21:36 6,656 –a—— C:\WINNT\system32\fxsres.dll
2006-11-14 21:36 596,480 –a—— C:\WINNT\system32\INETCOMM.DLL
2006-11-14 21:36 59,392 –a—— C:\WINNT\system32\iesetup.dll
2006-11-14 21:36 58,368 –a—— C:\WINNT\system32\dpvsetup.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\tlntadmn.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\nwwks.dll
2006-11-14 21:36 57,344 –a—— C:\WINNT\system32\dmcompos.dll
2006-11-14 21:36 56,320 –a—— C:\WINNT\system32\dpnhupnp.dll
2006-11-14 21:36 559,616 –a—— C:\WINNT\system32\fxsst.dll
2006-11-14 21:36 55,296 –a—— C:\WINNT\system32\digest.dll
2006-11-14 21:36 545,792 –a—— C:\WINNT\system32\wsecedit.dll
2006-11-14 21:36 54,272 –a—— C:\WINNT\system32\clusapi.dll
2006-11-14 21:36 53,248 –a—— C:\WINNT\system32\cryptsvc.dll
2006-11-14 21:36 51,712 –a—— C:\WINNT\system32\ipconfig.exe
2006-11-14 21:36 498,205 –a—— C:\WINNT\system32\dxmasf.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\ixsso.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\dpwsockx.dll
2006-11-14 21:36 49,152 –a—— C:\WINNT\system32\eventlog.dll
2006-11-14 21:36 489,984 –a—— C:\WINNT\system32\dbghelp.dll
2006-11-14 21:36 478,720 –a—— C:\WINNT\system32\mqsnap.dll
2006-11-14 21:36 471,040 –a—— C:\WINNT\system32\cryptui.dll
2006-11-14 21:36 467,456 –a—— C:\WINNT\system32\mqutil.dll
2006-11-14 21:36 45,568 –a—— C:\WINNT\system32\docprop2.dll
2006-11-14 21:36 443,392 –a—— C:\WINNT\system32\fxsapi.dll
2006-11-14 21:36 435,200 –a—— C:\WINNT\system32\ipnathlp.dll
2006-11-14 21:36 42,537 –a—— C:\WINNT\system32\keyboard.sys
2006-11-14 21:36 41,472 –a—— C:\WINNT\system32\cmdl32.exe
2006-11-14 21:36 395,264 –a—— C:\WINNT\system32\fxsxp32.dll
2006-11-14 21:36 391,168 –a—— C:\WINNT\system32\fxstiff.dll
2006-11-14 21:36 380,445 –a—— C:\WINNT\system32\expsrv.dll
2006-11-14 21:36 38,912 –a—— C:\WINNT\system32\hhsetup.dll
2006-11-14 21:36 36,922 –a—— C:\WINNT\system32\imeshare.dll
2006-11-14 21:36 35,328 –a—— C:\WINNT\system32\dfrgsnap.dll
2006-11-14 21:36 324,608 –a—— C:\WINNT\system32\cmdial32.dll
2006-11-14 21:36 318,464 –a—— C:\WINNT\system32\ippromon.dll
2006-11-14 21:36 31,744 –a—— C:\WINNT\system32\dmloader.dll
2006-11-14 21:36 307,712 –a—— C:\WINNT\system32\cscui.dll
2006-11-14 21:36 30,208 –a—— C:\WINNT\system32\imgutil.dll
2006-11-14 21:36 294,912 –a—— C:\WINNT\system32\iedkcs32.dll
2006-11-14 21:36 29,696 –a—— C:\WINNT\system32\dpnhpast.dll
2006-11-14 21:36 29,696 ——— C:\WINNT\system32\asr_pfu.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\ie4uinit.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\dbnmpntw.dll
2006-11-14 21:36 28,160 –a—— C:\WINNT\system32\pidgen.dll
2006-11-14 21:36 277,504 –a—— C:\WINNT\system32\appmgr.dll
2006-11-14 21:36 271,360 –a—— C:\WINNT\system32\fxscomex.dll
2006-11-14 21:36 266,240 –a—— C:\WINNT\system32\drmclien.dll
2006-11-14 21:36 263,680 –a—— C:\WINNT\system32\duser.dll
2006-11-14 21:36 263,168 –a—— C:\WINNT\system32\devmgr.dll
2006-11-14 21:36 26,112 –a—— C:\WINNT\system32\dmband.dll
2006-11-14 21:36 253,440 –a—— C:\WINNT\system32\ddraw.dll
2006-11-14 21:36 250,368 –a—— C:\WINNT\system32\fxssvc.exe
2006-11-14 21:36 25,600 –a—— C:\WINNT\system32\dfsshlex.dll
2006-11-14 21:36 249,856 –a—— C:\WINNT\system32\adsiis.dll
2006-11-14 21:36 240,640 –a—— C:\WINNT\system32\hnetcfg.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsvinn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsrpcn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\conime.exe
2006-11-14 21:36 24,064 –a—— C:\WINNT\system32\fxsdrv.dll
2006-11-14 21:36 238,592 –a—— C:\WINNT\system32\compatui.dll
2006-11-14 21:36 237,056 –a—— C:\WINNT\system32\icm32.dll
2006-11-14 21:36 236,032 –a—— C:\WINNT\system32\fxst30.dll
2006-11-14 21:36 231,936 –a—— C:\WINNT\system32\tracerpt.exe
2006-11-14 21:36 227,840 –a—— C:\WINNT\system32\dsquery.dll
2006-11-14 21:36 216,064 –a—— C:\WINNT\system32\fxscover.exe
2006-11-14 21:36 206,336 –a—— C:\WINNT\system32\dpvoice.dll
2006-11-14 21:36 204,288 –a—— C:\WINNT\system32\ieaksie.dll
2006-11-14 21:36 20,992 –a—— C:\WINNT\system32\fxsext32.dll
2006-11-14 21:36 20,480 –a—— C:\WINNT\system32\dbmsadsn.dll
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\fontview.exe
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\ersvc.dll
2006-11-14 21:36 185,856 –a—— C:\WINNT\system32\fxswzrd.dll
2006-11-14 21:36 183,808 –a—— C:\WINNT\system32\gptext.dll
2006-11-14 21:36 180,224 –a—— C:\WINNT\system32\dwwin.exe
2006-11-14 21:36 178,688 –a—— C:\WINNT\system32\eudcedit.exe
2006-11-14 21:36 172,544 –a—— C:\WINNT\system32\dmime.dll
2006-11-14 21:36 17,792 ——— C:\WINNT\system32\drivers\irbus.sys
2006-11-14 21:36 168,960 –a—— C:\WINNT\system32\dinput8.dll
2006-11-14 21:36 165,888 –a—— C:\WINNT\system32\mqrt.dll
2006-11-14 21:36 165,376 –a—— C:\WINNT\system32\els.dll
2006-11-14 21:36 164,352 –a—— C:\WINNT\system32\mqtrig.dll
2006-11-14 21:36 16,384 –a—— C:\WINNT\system32\ds32gt.dll
2006-11-14 21:36 158,720 –a—— C:\WINNT\system32\credui.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\dpnet.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\appmgmts.dll
2006-11-14 21:36 156,544 –a—— C:\WINNT\system32\drivers\nwrdr.sys
2006-11-14 21:36 151,552 –a—— C:\WINNT\system32\dinput.dll
2006-11-14 21:36 149,504 –a—— C:\WINNT\system32\fxsui.dll
2006-11-14 21:36 143,872 –a—— C:\WINNT\system32\itircl.dll
2006-11-14 21:36 14,848 –a—— C:\WINNT\system32\mqise.dll
2006-11-14 21:36 135,680 –a—— C:\WINNT\system32\dsprop.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\mqad.dll
2006-11-14 21:36 130,048 –a—— C:\WINNT\system32\fxsclnt.exe
2006-11-14 21:36 13,312 –a—— C:\WINNT\system32\ctfmon.exe
2006-11-14 21:36 128,000 –a—— C:\WINNT\system32\itss.dll
2006-11-14 21:36 126,976 –a—— C:\WINNT\system32\ieakeng.dll
2006-11-14 21:36 124,928 –a—— C:\WINNT\system32\dssenh.dll
2006-11-14 21:36 123,904 –a—— C:\WINNT\system32\imapi.exe
2006-11-14 21:36 115,200 –a—— C:\WINNT\system32\dpcdll.dll
2006-11-14 21:36 114,176 –a—— C:\WINNT\system32\input.dll
2006-11-14 21:36 113,664 –a—— C:\WINNT\system32\schtasks.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\idq.dll
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\gpresult.exe
2006-11-14 21:36 113,152 –a—— C:\WINNT\system32\dfrgui.dll
2006-11-14 21:36 110,080 –a—— C:\WINNT\system32\dmstyle.dll
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\rsnotify.exe
2006-11-14 21:36 103,936 –a—— C:\WINNT\system32\imm32.dll
2006-11-14 21:36 103,424 –a—— C:\WINNT\system32\dgnet.dll
2006-11-14 21:36 10,752 ——— C:\WINNT\system32\spiisupd.exe
2006-11-14 21:36 1,180,672 –a—— C:\WINNT\system32\d3d8.dll
2006-11-14 21:36 1,004,032 –a—— C:\WINNT\explorer.exe
2006-11-14 21:35 91,648 –a—— C:\WINNT\system32\ahui.exe
2006-11-14 21:35 91,136 –a—— C:\WINNT\system32\advpack.dll
2006-11-14 21:35 8,192 –a—— C:\WINNT\system32\autolfn.exe
2006-11-14 21:35 76,288 –a—— C:\WINNT\system32\avifil32.dll
2006-11-14 21:35 74,810 –a—— C:\WINNT\system32\atl.dll
2006-11-14 21:35 71,680 –a—— C:\WINNT\system32\browsewm.dll
2006-11-14 21:35 64,512 –a—— C:\WINNT\system32\ciodm.dll
2006-11-14 21:35 62,976 –a—— C:\WINNT\system32\browselc.dll
2006-11-14 21:35 62,464 –a—— C:\WINNT\system32\adsmsext.dll
2006-11-14 21:35 6,656 –a—— C:\WINNT\system32\batt.dll
2006-11-14 21:35 59,904 –a—— C:\WINNT\system32\cabinet.dll
2006-11-14 21:35 5,120 –a—— C:\WINNT\system32\asferror.dll
2006-11-14 21:35 49,152 –a—— C:\WINNT\system32\browser.dll
2006-11-14 21:35 41,984 –a—— C:\WINNT\system32\alg.exe
2006-11-14 21:35 38,912 –a—— C:\WINNT\system32\audiosrv.dll
2006-11-14 21:35 32,768 –a—— C:\WINNT\system32\cfgbkend.dll
2006-11-14 21:35 32,512 ——— C:\WINNT\system32\drivers\amdk7.sys
2006-11-14 21:35 239,616 –a—— C:\WINNT\system32\adsnt.dll
2006-11-14 21:35 22,528 –a—— C:\WINNT\system32\at.exe
2006-11-14 21:35 186,880 –a—— C:\WINNT\system32\certcli.dll
2006-11-14 21:35 162,816 –a—— C:\WINNT\system32\adsldp.dll
2006-11-14 21:35 14,366 –a—— C:\WINNT\system32\asfsipc.dll
2006-11-14 21:35 139,776 –a—— C:\WINNT\system32\adsldpc.dll
2006-11-14 21:35 115,712 –a—— C:\WINNT\system32\apphelp.dll
2006-11-14 20:57 29,696 –a—— C:\WINNT\system32\57484702ld.exe
2006-11-14 20:36 29,696 –a—— C:\WINNT\system32\36532452ld.exe
2006-11-14 20:30 29,696 –a—— C:\WINNT\system32\30377002ld.exe
2006-11-14 20:19 593,408 –a—— C:\WINNT\system32\h323msp.dll
2006-11-14 20:15 97,280 –a—— C:\WINNT\system32\txflog.dll
2006-11-14 20:10 29,696 –a—— C:\WINNT\system32\10107562ld.exe
2006-11-14 19:49 29,696 –a—— C:\WINNT\system32\49432912ld.exe
2006-11-14 19:29 29,696 –a—— C:\WINNT\system32\2985352ld.exe
2006-11-14 19:08 29,696 –a—— C:\WINNT\system32\8135512ld.exe
2006-11-14 18:57 29,696 –a—— C:\WINNT\system32\57185702ld.exe
2006-11-14 18:51 127,208 –a—— C:\WINNT\system32\mucltui.dll
2006-11-14 18:36 29,696 –a—— C:\WINNT\system32\3652772ld.exe
2006-11-14 00:46 29,184 –a—— C:\WINNT\system32\46155532ld.exe
2006-11-14 00:26 29,184 –a—— C:\WINNT\system32\26121122ld.exe
2006-11-13 23:39 29,184 –a—— C:\WINNT\system32\3913322ld.exe
2006-11-13 23:19 29,184 –a—— C:\WINNT\system32\1979192ld.exe
2006-11-13 22:59 29,184 –a—— C:\WINNT\system32\5925362ld.exe
2006-11-13 22:38 29,184 –a—— C:\WINNT\system32\38589652ld.exe
2006-11-13 22:18 29,184 –a—— C:\WINNT\system32\18547532ld.exe
2006-11-13 21:37 29,184 –a—— C:\WINNT\system32\37469462ld.exe
2006-11-13 21:17 29,184 –a—— C:\WINNT\system32\17427042ld.exe
2006-11-13 20:57 29,184 –a—— C:\WINNT\system32\57379322ld.exe
2006-11-13 20:37 29,184 –a—— C:\WINNT\system32\3733802ld.exe
2006-11-13 20:17 29,184 –a—— C:\WINNT\system32\17205362ld.exe
2006-11-13 17:46 29,184 –a—— C:\WINNT\system32\4608942ld.exe
2006-11-13 17:29 29,184 –a—— C:\WINNT\system32\293082ld.exe
2006-11-13 17:09 29,184 –a—— C:\WINNT\system32\9255262ld.exe
2006-11-13 16:49 29,184 –a—— C:\WINNT\system32\49224962ld.exe
2006-11-13 12:52 29,184 –a—— C:\WINNT\system32\52105722ld.exe
2006-11-13 12:32 29,184 –a—— C:\WINNT\system32\3272312ld.exe
2006-11-13 12:12 29,184 –a—— C:\WINNT\system32\1235402ld.exe
2006-11-13 09:34 29,184 –a—— C:\WINNT\system32\3434132ld.exe
2006-11-12 00:58 2,585,872 –a—— C:\WindowsInstaller-KB893803-v2-x86.exe
2006-11-12 00:54 9,692,736 –a—— C:\nmsetup.exe
2006-11-09 02:27 51,072 –a—— C:\WINNT\system32\drivers\ikhlayer.sys
2006-11-09 02:27 30,592 –a—— C:\WINNT\system32\drivers\ikhfile.sys
2006-11-09 02:24 8,598,632 –a—— C:\WINNT\sdsetup.exe
2006-11-08 21:42 7,168 –a—— C:\WINNT\system32\wamregps.dll
2006-11-08 21:42 60,416 –a—— C:\WINNT\system32\iismap.dll
2006-11-08 21:42 59,392 –a—— C:\WINNT\system32\iisext.dll
2006-11-08 21:42 34,816 –a—— C:\WINNT\system32\admwprox.dll
2006-11-08 21:42 3,584 –a—— C:\WINNT\system32\iismui.dll
2006-11-08 21:42 19,968 –a—— C:\WINNT\system32\inetsloc.dll
2006-11-08 21:42 13,312 –a—— C:\WINNT\system32\exstrace.dll
2006-11-08 21:42 120,832 –a—— C:\WINNT\system32\iisRtl.dll
2006-11-08 21:42 11,776 –a—— C:\WINNT\system32\infoadmn.dll
2006-11-08 21:22 24,661 –a—— C:\WINNT\system32\spxcoins.dll
2006-11-08 21:22 13,312 –a—— C:\WINNT\system32\irclass.dll
2006-11-08 20:33 124,184 –a—— C:\WINNT\system32\wuauclt.exe
2006-11-08 20:33 1,343,768 –a—— C:\WINNT\system32\wuaueng.dll
2006-11-03 03:19 499,200 –a—— C:\WINNT\system32\comuid.dll
2006-11-03 03:19 150,528 –a—— C:\WINNT\system32\msdtcuiu.dll
2006-11-03 03:18 974,336 –a—— C:\WINNT\system32\msdtctm.dll
2006-11-03 03:18 368,640 –a—— C:\WINNT\system32\msdtcprx.dll
2006-11-03 03:18 110,080 –a—— C:\WINNT\system32\clbcatex.dll
2006-11-02 23:35 8,464 –a—— C:\WINNT\system32\sporder.dll
2006-11-02 01:51 7,680 ——— C:\WINNT\system32\bitsprx2.dll
2006-11-02 01:51 7,168 ——— C:\WINNT\system32\bitsprx3.dll
2006-11-02 01:51 17,408 –a—— C:\WINNT\system32\qmgrprxy.dll
2006-11-02 01:50 331,776 –a—— C:\WINNT\system32\winhttp.dll
2006-11-02 01:37 d——– C:\WINNT\McAfee.com
2006-11-01 13:37 1,259 –a—— C:\WINNT\system32\yum96b4e.sys
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
Rootkit driver pe386 is present. A rootkit scan is required
2006-11-22 13:03 ——– d——– C:\Documents and Settings\Tessa\Application Data\Azureus
2006-11-22 12:54 ——– d——– C:\Program Files\Spyware Doctor
2006-11-21 23:43 9900 –a—— C:\Program Files\BBToolBar2.INI
2006-11-21 23:43 96 –a—— C:\Program Files\Default7BBC
2006-11-21 23:43 768 –a—— C:\Program Files\MySetup.DK
2006-11-21 23:43 46823 –a—— C:\Program Files\intrface.bbw
2006-11-21 23:43 3200 –a—— C:\Program Files\DEFAULT.ALI
2006-11-20 22:16 ——– d——– C:\Program Files\Grisoft
2006-11-20 16:21 ——– d-a—— C:\Program Files\Accessories
2006-11-20 16:21 ——– d——– C:\Program Files\PSDream
2006-11-20 15:03 ——– d——– C:\Documents and Settings\Tessa\Application Data\MSN6
2006-11-20 02:25 ——– d-a—— C:\Program Files\Common Files
2006-11-20 01:53 ——– d——– C:\Program Files\HJT
2006-11-18 19:12 40 –a—— C:\Program Files\Tuner.cfg
2006-11-18 19:07 80 –a–c— C:\Program Files\BURN.TXT
2006-11-18 16:56 203 –a–c— C:\Program Files\BBWERROR.LOG
2006-11-17 09:05 ——– d——– C:\Program Files\Messenger
2006-11-16 04:45 ——– d——– C:\Program Files\TrojanHunter 4.2
2006-11-16 04:07 ——– d-a—— C:\Program Files\Windows Media Player
2006-11-16 03:24 ——– d-a—— C:\Program Files\Outlook Express
2006-11-16 03:24 ——– d-a—— C:\Program Files\Common Files\System
2006-11-14 21:58 ——– d-a—— C:\Program Files\Internet Explorer
2006-11-14 21:48 ——– d-a—— C:\Program Files\NetMeeting
2006-11-14 21:48 ——– d——– C:\Program Files\Movie Maker
2006-11-14 18:50 ——– d-ah—– C:\Program Files\WindowsUpdate
2006-11-13 22:17 ——– d——– C:\Program Files\Google
2006-11-11 22:48 ——– d——– C:\Documents and Settings\Tessa\Application Data\DriveCleaner 2006 Free
2006-11-09 04:31 ——– d—s—- C:\Documents and Settings\Tessa\Application Data\Microsoft
2006-11-09 04:28 ——– d——– C:\Program Files\SpywareBlaster
2006-11-09 02:43 ——– d——– C:\Documents and Settings\Tessa\Application Data\Google
2006-11-09 02:27 ——– d——– C:\Documents and Settings\Tessa\Application Data\PC Tools
2006-11-09 02:09 ——– d-a—— C:\Program Files\Common Files\Services
2006-11-07 20:24 ——– d——– C:\Program Files\Dantz
2006-11-07 20:21 ——– d-a—— C:\Program Files\Common Files\InstallShield
2006-11-06 01:13 48128 –ahs—- C:\Program Files\Thumbs.db
2006-11-05 23:43 ——– d——– C:\Program Files\WinRAR
2006-11-03 00:21 ——– d——– C:\Program Files\Creative
2006-11-02 23:12 ——– d——– C:\Program Files\Azureus
2006-11-02 01:16 ——– d——– C:\Program Files\Lavasoft
2006-11-02 01:16 ——– d——– C:\Documents and Settings\Tessa\Application Data\Lavasoft
2006-11-02 00:50 ——– d——– C:\Program Files\Common Files\iS3
2006-11-01 21:52 ——– d-a—— C:\Program Files\Common Files\Symantec Shared
2006-11-01 21:41 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-10-29 19:00 ——– d——– C:\Program Files\Sonic Foundry ACID Music
2006-10-28 15:37 ——– d——– C:\Program Files\QuickTime
2006-10-26 23:52 ——– d——– C:\Documents and Settings\Tessa\Application Data\Apple Computer
2006-10-13 23:07 ——– d——– C:\Documents and Settings\Tessa\Application Data\eFax Messenger
2006-10-11 08:18 ——– d——– C:\Program Files\Yahoo!
2006-10-07 15:20 192 –a—— C:\Program Files\$MIDIMON.cfg
2006-10-03 23:35 ——– d——– C:\Program Files\Citrix
2006-10-03 23:35 ——– d——– C:\Documents and Settings\Tessa\Application Data\ICAClient
2006-09-27 15:53 ——– d——– C:\Documents and Settings\Tessa\Application Data\Yahoo!
2006-09-27 07:36 ——– d——– C:\Documents and Settings\Tessa\Application Data\Image Zone Express
2006-09-27 07:35 ——– d——– C:\Program Files\DebugMode
2006-09-27 07:24 ——– d-a—— C:\Program Files\Adobe
2006-09-27 07:24 ——– d——– C:\Program Files\Sonic Foundry
2006-09-27 07:24 ——– d——– C:\Program Files\Pure Motion
2006-09-12 23:09 1110528 –a—— C:\WINNT\system32\msxml3.dll
2006-08-26 16:48 91098 –ah-c— C:\Program Files\bbw.GID
2006-08-26 13:31 16784 —–c— C:\Documents and Settings\Tessa\Application Data\GDIPFONTCACHEV1.DAT
2006-08-25 09:53 561664 –a—— C:\WINNT\system32\comctl32.dll
2006-08-25 03:14 595968 –a—— C:\WINNT\system32\xpsp2res.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
"MSMSGS"="\"C:\\Program Files\\Messenger\\MSMSGS.EXE\" /background"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Synchronization Manager"="mobsync.exe /logon"
"AtiPTA"="atiptaxx.exe"
"POINTER"="point32.exe"
"NeroFilterCheck"="C:\\WINNT\\system32\\NeroCheck.exe"
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"THGuard"="\"C:\\Program Files\\TrojanHunter 4.2\\THGuard.exe\""
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
"msconfig"="C:\\WINNT\\scvhost.exe"
"Update Checker"="C:\\WINNT\\scvhost.exe"
@="C:\\WINNT\\scvhost.exe"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00000000
"Position"=hex:2c,00,00,00,00,00,00,00,01,00,00,00,dc,00,00,00,d0,00,00,00,e8,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:01,00,00,00
"OriginalStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,01,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,01,00,00,00
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
"Source"="C:\\Program Files\\Common Files\\mehe.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=hex:01,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Htal"="\"C:\\WINNT\\system32\\config\\SYSTEM~1\\MYDOCU~1\\ASKS~1\\msiexec.exe\" -vt yazb"
"PSDream"="\"C:\\Program Files\\PSDream\\PSDream.exe\""
"Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=dword:00000000
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\Backup.job
C:\WINNT\tasks\Disk Cleanup.job
C:\WINNT\tasks\Symantec NetDetect.job
Completion time: 06-11-22 13:04:32.38
C:\ComboFix.txt … 06-11-22 13:04
C:\ComboFix2.txt … 06-11-20 23:06
C:\ComboFix3.txt … 06-11-18 12:14
1. Please download The Avenger by Swandog46 to your Desktop.
http://swandog46.geekstogo.com/avenger.zip
Click on Avenger.zip to open the file
Extract avenger.exe to your desktop
2. Copy all the text in bold contained in the code box below to your Clipboard:
Files to delete:
C:\WINNT\System32\lzx32.sys
C:\WINNT\system32\167982ld.exe
C:\WINNT\system32\53432732ld.exe
C:\WINNT\system32\32547982ld.exe
C:\WINNT\system32\12298362ld.exe
C:\WINNT\system32\28306052ld.exe
C:\WINNT\system32\886072ld.exe
C:\WINNT\system32\41219972ld.exe
C:\WINNT\system32\tmp_2k4.exe
C:\WINNT\system32\412192ld.exe
C:\WINNT\system32\3102792ld.exe
C:\WINNT\system32\24545722ld.exe
C:\WINNT\system32\3555922ld.exe
C:\WINNT\system32\43131452ld.exe
C:\WINNT\system32\2212222ld.exe
C:\WINNT\system32\21201142ld.exe
C:\WINNT\system32\0224152ld.exe
C:\WINNT\system32\39361832ld.exe
C:\WINNT\system32\1984282ld.exe
C:\WINNT\system32\5841132ld.exe
C:\WINNT\system32\38196372ld.exe
C:\WINNT\system32\17448212ld.exe
C:\WINNT\system32\5713132ld.exe
C:\WINNT\system32\1107362ld.exe
C:\WINNT\system32\40468662ld.exe
C:\WINNT\system32\19482062ld.exe
C:\WINNT\system32\59286322ld.exe
C:\WINNT\system32\38348792ld.exe
C:\WINNT\system32\17385532ld.exe
C:\WINNT\system32\56492772ld.exe
C:\WINNT\system32\37114812ld.exe
C:\WINNT\system32\1715712ld.exe
C:\WINNT\system32\5494852ld.exe
C:\WINNT\system32\4541852ld.exe
C:\WINNT\system32\22231992ld.exe
C:\WINNT\system32\36423522ld.exe
C:\WINNT\system32\15458552ld.exe
C:\WINNT\system32\54599532ld.exe
C:\WINNT\system32\46505802ld.exe
C:\WINNT\system32\58144492ld.exe
C:\WINNT\system32\ipv6monl.dll
C:\WINNT\system32\37133662ld.exe
C:\WINNT\system32\43524502ld.exe
C:\WINNT\system32\22528182ld.exe
C:\WINNT\system32\1493122ld.exe
C:\WINNT\system32\4045242ld.exe
C:\WINNT\system32\18337092ld.exe
C:\WINNT\system32\56385582ld.exe
C:\WINNT\system32\53532512ld.exe
C:\WINNT\system32\31547052ld.exe
C:\WINNT\system32\19346342ld.exe
C:\WINNT\system32\5925132ld.exe
C:\WINNT\system32\31252662ld.exe
C:\WINNT\system32\922052ld.exe
C:\WINNT\system32\6222652ld.exe
C:\WINNT\system32\3577872ld.exe
C:\WINNT\system32\1354432ld.exe
C:\WINNT\system32\59306032ld.exe
C:\WINNT\system32\57282472ld.exe
C:\WINNT\system32\54536052ld.exe
C:\WINNT\system32\33523612ld.exe
C:\WINNT\system32\setup.exe
C:\WINNT\system32\57484702ld.exe
C:\WINNT\system32\36532452ld.exe
C:\WINNT\system32\30377002ld.exe
C:\WINNT\system32\10107562ld.exe
C:\WINNT\system32\49432912ld.exe
C:\WINNT\system32\2985352ld.exe
C:\WINNT\system32\8135512ld.exe
C:\WINNT\system32\57185702ld.exe
C:\WINNT\system32\3652772ld.exe
C:\WINNT\system32\46155532ld.exe
C:\WINNT\system32\26121122ld.exe
C:\WINNT\system32\3913322ld.exe
C:\WINNT\system32\1979192ld.exe
C:\WINNT\system32\5925362ld.exe
C:\WINNT\system32\38589652ld.exe
C:\WINNT\system32\18547532ld.exe
C:\WINNT\system32\37469462ld.exe
C:\WINNT\system32\17427042ld.exe
C:\WINNT\system32\57379322ld.exe
C:\WINNT\system32\3733802ld.exe
C:\WINNT\system32\17205362ld.exe
C:\WINNT\system32\4608942ld.exe
C:\WINNT\system32\293082ld.exe
C:\WINNT\system32\9255262ld.exe
C:\WINNT\system32\49224962ld.exe
C:\WINNT\system32\52105722ld.exe
C:\WINNT\system32\3272312ld.exe
C:\WINNT\system32\1235402ld.exe
C:\WINNT\system32\3434132ld.exe
C:\WINNT\system32\yum96b4e.sys
C:\WINNT\scvhost.exe
Please make sure you COPY above and not type it!
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, start The Avenger program by clicking on its icon on your desktop.
Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, briefly open a black command window on your desktop, this is normal.
After the restart, create a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of avenger.txt into your reply along with a fresh HJT log by using Add/Reply
I downloaded Avenger and did everything you said…. copied the files into the script… but when I clicked the green light button the following messages came up:
Error: selected file does not appear to be a valid script (I clicked OK) then:
Press OK to log error and continue or Cancel to abort (I clicked OK) then:
Error Code: 1813
Help????
PS: Hope you had a good Thanksgiving!!
Ok I got, I didn't realize that I need to copy the first line also.
Here is the Avenger log:
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\mbtwrjng
*******************
Script file located at: \??\C:\Documents and Settings\mcpjuehy.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINNT\System32\lzx32.sys not found!
Deletion of file C:\WINNT\System32\lzx32.sys failed!
Could not process line:
C:\WINNT\System32\lzx32.sys
Status: 0xc0000034
File C:\WINNT\system32\167982ld.exe not found!
Deletion of file C:\WINNT\system32\167982ld.exe failed!
Could not process line:
C:\WINNT\system32\167982ld.exe
Status: 0xc0000034
File C:\WINNT\system32\53432732ld.exe deleted successfully.
File C:\WINNT\system32\32547982ld.exe deleted successfully.
File C:\WINNT\system32\12298362ld.exe deleted successfully.
File C:\WINNT\system32\28306052ld.exe deleted successfully.
File C:\WINNT\system32\886072ld.exe deleted successfully.
File C:\WINNT\system32\41219972ld.exe deleted successfully.
File C:\WINNT\system32\tmp_2k4.exe deleted successfully.
File C:\WINNT\system32\412192ld.exe deleted successfully.
File C:\WINNT\system32\3102792ld.exe deleted successfully.
File C:\WINNT\system32\24545722ld.exe deleted successfully.
File C:\WINNT\system32\3555922ld.exe deleted successfully.
File C:\WINNT\system32\43131452ld.exe deleted successfully.
File C:\WINNT\system32\2212222ld.exe deleted successfully.
File C:\WINNT\system32\21201142ld.exe deleted successfully.
File C:\WINNT\system32\0224152ld.exe deleted successfully.
File C:\WINNT\system32\39361832ld.exe deleted successfully.
File C:\WINNT\system32\1984282ld.exe deleted successfully.
File C:\WINNT\system32\5841132ld.exe deleted successfully.
File C:\WINNT\system32\38196372ld.exe deleted successfully.
File C:\WINNT\system32\17448212ld.exe deleted successfully.
File C:\WINNT\system32\5713132ld.exe deleted successfully.
File C:\WINNT\system32\1107362ld.exe deleted successfully.
File C:\WINNT\system32\40468662ld.exe deleted successfully.
File C:\WINNT\system32\19482062ld.exe deleted successfully.
File C:\WINNT\system32\59286322ld.exe deleted successfully.
File C:\WINNT\system32\38348792ld.exe deleted successfully.
File C:\WINNT\system32\17385532ld.exe deleted successfully.
File C:\WINNT\system32\56492772ld.exe deleted successfully.
File C:\WINNT\system32\37114812ld.exe deleted successfully.
File C:\WINNT\system32\1715712ld.exe deleted successfully.
File C:\WINNT\system32\5494852ld.exe deleted successfully.
File C:\WINNT\system32\4541852ld.exe deleted successfully.
File C:\WINNT\system32\22231992ld.exe deleted successfully.
File C:\WINNT\system32\36423522ld.exe deleted successfully.
File C:\WINNT\system32\15458552ld.exe deleted successfully.
File C:\WINNT\system32\54599532ld.exe deleted successfully.
File C:\WINNT\system32\46505802ld.exe deleted successfully.
File C:\WINNT\system32\58144492ld.exe deleted successfully.
File C:\WINNT\system32\ipv6monl.dll deleted successfully.
File C:\WINNT\system32\37133662ld.exe deleted successfully.
File C:\WINNT\system32\43524502ld.exe deleted successfully.
File C:\WINNT\system32\22528182ld.exe deleted successfully.
File C:\WINNT\system32\1493122ld.exe deleted successfully.
File C:\WINNT\system32\4045242ld.exe deleted successfully.
File C:\WINNT\system32\18337092ld.exe deleted successfully.
File C:\WINNT\system32\56385582ld.exe deleted successfully.
File C:\WINNT\system32\53532512ld.exe deleted successfully.
File C:\WINNT\system32\31547052ld.exe deleted successfully.
File C:\WINNT\system32\19346342ld.exe deleted successfully.
File C:\WINNT\system32\5925132ld.exe deleted successfully.
File C:\WINNT\system32\31252662ld.exe deleted successfully.
File C:\WINNT\system32\922052ld.exe deleted successfully.
File C:\WINNT\system32\6222652ld.exe deleted successfully.
File C:\WINNT\system32\3577872ld.exe deleted successfully.
File C:\WINNT\system32\1354432ld.exe deleted successfully.
File C:\WINNT\system32\59306032ld.exe deleted successfully.
File C:\WINNT\system32\57282472ld.exe deleted successfully.
File C:\WINNT\system32\54536052ld.exe deleted successfully.
File C:\WINNT\system32\33523612ld.exe deleted successfully.
File C:\WINNT\system32\setup.exe deleted successfully.
File C:\WINNT\system32\57484702ld.exe deleted successfully.
File C:\WINNT\system32\36532452ld.exe deleted successfully.
File C:\WINNT\system32\30377002ld.exe deleted successfully.
File C:\WINNT\system32\10107562ld.exe deleted successfully.
File C:\WINNT\system32\49432912ld.exe deleted successfully.
File C:\WINNT\system32\2985352ld.exe deleted successfully.
File C:\WINNT\system32\8135512ld.exe deleted successfully.
File C:\WINNT\system32\57185702ld.exe deleted successfully.
File C:\WINNT\system32\3652772ld.exe deleted successfully.
File C:\WINNT\system32\46155532ld.exe deleted successfully.
File C:\WINNT\system32\26121122ld.exe deleted successfully.
File C:\WINNT\system32\3913322ld.exe deleted successfully.
File C:\WINNT\system32\1979192ld.exe deleted successfully.
File C:\WINNT\system32\5925362ld.exe deleted successfully.
File C:\WINNT\system32\38589652ld.exe deleted successfully.
File C:\WINNT\system32\18547532ld.exe deleted successfully.
File C:\WINNT\system32\37469462ld.exe deleted successfully.
File C:\WINNT\system32\17427042ld.exe deleted successfully.
File C:\WINNT\system32\57379322ld.exe deleted successfully.
File C:\WINNT\system32\3733802ld.exe deleted successfully.
File C:\WINNT\system32\17205362ld.exe deleted successfully.
File C:\WINNT\system32\4608942ld.exe deleted successfully.
File C:\WINNT\system32\293082ld.exe deleted successfully.
File C:\WINNT\system32\9255262ld.exe deleted successfully.
File C:\WINNT\system32\49224962ld.exe deleted successfully.
File C:\WINNT\system32\52105722ld.exe deleted successfully.
File C:\WINNT\system32\3272312ld.exe deleted successfully.
File C:\WINNT\system32\1235402ld.exe deleted successfully.
File C:\WINNT\system32\3434132ld.exe deleted successfully.
File C:\WINNT\system32\yum96b4e.sys deleted successfully.
File C:\WINNT\scvhost.exe not found!
Deletion of file C:\WINNT\scvhost.exe failed!
Could not process line:
C:\WINNT\scvhost.exe
Status: 0xc0000034
Completed script processing.
*******************
Finished! Terminate.
And here is the HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 10:29:04 PM, on 11/25/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINNT\System32\CTSvcCDA.exe
C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\atiptaxx.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\System32\wbem\wmiprvse.exe
F:\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'prxernsp.dll' missing
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) -
http://www.rawflow.com/passion/Rawflow.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-3-48.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/…b?1124499090416
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1163551812568
O16 - DPF: {89242969-422B-46BF-B0D5-6A7B7DC4D0E0} (NAS Finder Helper) - file://D:\html\nafcom.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
http://download.mcafee.com/molbin/iss-loc/…886/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E99E132C-52F1-4ABE-8A04-D6583D60C55F}: NameServer = 24.196.64.53,68.115.71.53
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTSvcCDA.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Dantz - C:\Program Files\Dantz\Retrospect 7.0\retrorun.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
THanks!!!
That looks better.
Please run another Combofix.
Doubleclick combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
Okay
here is combo fix:
Tessa - 06-11-26 12:21:18.38 Service Pack 1
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Tessa\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2006-10-26 to 2006-11-26 ))))))))))))))))))))))))))))))))))
2006-11-22 22:47 53,248 –a—— C:\WINNT\system32\PrxerNsp.dll
2006-11-22 22:47 53,248 –a—— C:\WINNT\system32\PrxerNsp.dll
2006-11-22 22:47 53,248 –a—— C:\WINNT\system32\PrxerDrv.dll
2006-11-22 22:47 53,248 –a—— C:\WINNT\system32\PrxerDrv.dll
2006-11-18 16:23 3,968 –a—— C:\WINNT\system32\drivers\AvgAsCln.sys
2006-11-18 16:23 3,968 –a—— C:\WINNT\system32\drivers\AvgAsCln.sys
2006-11-16 22:11 47,104 –a—— C:\ATF-Cleaner.exe
2006-11-16 22:11 47,104 –a—— C:\ATF-Cleaner.exe
2006-11-15 21:26 991,232 –a—— C:\WINNT\system32\esent.dll
2006-11-15 21:26 991,232 –a—— C:\WINNT\system32\esent.dll
2006-11-14 21:38 98,304 –a—— C:\WINNT\system32\oleprn.dll
2006-11-14 21:38 98,304 –a—— C:\WINNT\system32\oleprn.dll
2006-11-14 21:38 94,208 –a—— C:\WINNT\system32\odbccp32.dll
2006-11-14 21:38 94,208 –a—— C:\WINNT\system32\odbccp32.dll
2006-11-14 21:38 91,136 –a—— C:\WINNT\system32\rastls.dll
2006-11-14 21:38 91,136 –a—— C:\WINNT\system32\rastls.dll
2006-11-14 21:38 9,216 –a—— C:\WINNT\system32\wuauserv.dll
2006-11-14 21:38 9,216 –a—— C:\WINNT\system32\wuauserv.dll
2006-11-14 21:38 891,711 ——— C:\WINNT\system32\drivers\nv4_mini.sys
2006-11-14 21:38 891,711 ——— C:\WINNT\system32\drivers\nv4_mini.sys
2006-11-14 21:38 88,064 –a—— C:\WINNT\system32\tscfgwmi.dll
2006-11-14 21:38 88,064 –a—— C:\WINNT\system32\tscfgwmi.dll
2006-11-14 21:38 87,304 –a—— C:\WINNT\system32\rdpdd.dll
2006-11-14 21:38 87,304 –a—— C:\WINNT\system32\rdpdd.dll
2006-11-14 21:38 86,528 –a—— C:\WINNT\system32\wlnotify.dll
2006-11-14 21:38 86,528 –a—— C:\WINNT\system32\wlnotify.dll
2006-11-14 21:38 86,016 –a—— C:\WINNT\system32\xactsrv.dll
2006-11-14 21:38 86,016 –a—— C:\WINNT\system32\xactsrv.dll
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\smlogsvc.exe
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\smlogsvc.exe
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\psbase.dll
2006-11-14 21:38 82,944 –a—— C:\WINNT\system32\psbase.dll
2006-11-14 21:38 81,920 –a—— C:\WINNT\system32\trkwks.dll
2006-11-14 21:38 81,920 –a—— C:\WINNT\system32\trkwks.dll
2006-11-14 21:38 8,192 –a—— C:\WINNT\system32\scrnsave.scr
2006-11-14 21:38 8,192 –a—— C:\WINNT\system32\scrnsave.scr
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpstub.exe
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpstub.exe
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpshell.dll
2006-11-14 21:38 77,824 –a—— C:\WINNT\system32\wmpshell.dll
2006-11-14 21:38 75,912 –a—— C:\WINNT\system32\rdpwsx.dll
2006-11-14 21:38 75,912 –a—— C:\WINNT\system32\rdpwsx.dll
2006-11-14 21:38 74,240 –a—— C:\WINNT\system32\rtcshare.exe
2006-11-14 21:38 74,240 –a—— C:\WINNT\system32\rtcshare.exe
2006-11-14 21:38 72,192 –a—— C:\WINNT\system32\telnet.exe
2006-11-14 21:38 72,192 –a—— C:\WINNT\system32\telnet.exe
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\storprop.dll
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\storprop.dll
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\sdbinst.exe
2006-11-14 21:38 71,168 –a—— C:\WINNT\system32\sdbinst.exe
2006-11-14 21:38 686,080 –a—— C:\WINNT\system32\opengl32.dll
2006-11-14 21:38 686,080 –a—— C:\WINNT\system32\opengl32.dll
2006-11-14 21:38 667,648 –a—— C:\WINNT\system32\ss3dfo.scr
2006-11-14 21:38 667,648 –a—— C:\WINNT\system32\ss3dfo.scr
2006-11-14 21:38 66,560 –a—— C:\WINNT\system32\spoolss.dll
2006-11-14 21:38 66,560 –a—— C:\WINNT\system32\spoolss.dll
2006-11-14 21:38 66,048 –a—— C:\WINNT\system32\sigverif.exe
2006-11-14 21:38 66,048 –a—— C:\WINNT\system32\sigverif.exe
2006-11-14 21:38 638,976 –a—— C:\WINNT\system32\sstext3d.scr
2006-11-14 21:38 638,976 –a—— C:\WINNT\system32\sstext3d.scr
2006-11-14 21:38 63,488 –a—— C:\WINNT\system32\srclient.dll
2006-11-14 21:38 63,488 –a—— C:\WINNT\system32\srclient.dll
2006-11-14 21:38 62,976 –a—— C:\WINNT\system32\shgina.dll
2006-11-14 21:38 62,976 –a—— C:\WINNT\system32\shgina.dll
2006-11-14 21:38 61,952 –a—— C:\WINNT\system32\sti.dll
2006-11-14 21:38 61,952 –a—— C:\WINNT\system32\sti.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccu32.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccu32.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccr32.dll
2006-11-14 21:38 61,440 –a—— C:\WINNT\system32\odbccr32.dll
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\wextract.exe
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\wextract.exe
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\shimeng.dll
2006-11-14 21:38 60,416 –a—— C:\WINNT\system32\shimeng.dll
2006-11-14 21:38 6,144 –a—— C:\WINNT\system32\sensapi.dll
2006-11-14 21:38 6,144 –a—— C:\WINNT\system32\sensapi.dll
2006-11-14 21:38 58,880 –a—— C:\WINNT\system32\pautoenr.dll
2006-11-14 21:38 58,880 –a—— C:\WINNT\system32\pautoenr.dll
2006-11-14 21:38 57,856 –a—— C:\WINNT\system32\raschap.dll
2006-11-14 21:38 57,856 –a—— C:\WINNT\system32\raschap.dll
2006-11-14 21:38 569,344 –a—— C:\WINNT\system32\sspipes.scr
2006-11-14 21:38 569,344 –a—— C:\WINNT\system32\sspipes.scr
2006-11-14 21:38 56,832 –a—— C:\WINNT\system32\wzcdlg.dll
2006-11-14 21:38 56,832 –a—— C:\WINNT\system32\wzcdlg.dll
2006-11-14 21:38 56,320 –a—— C:\WINNT\system32\remotepg.dll
2006-11-14 21:38 56,320 –a—— C:\WINNT\system32\remotepg.dll
2006-11-14 21:38 548,864 –a—— C:\WINNT\system32\rtcdll.dll
2006-11-14 21:38 548,864 –a—— C:\WINNT\system32\rtcdll.dll
2006-11-14 21:38 534,016 –a—— C:\WINNT\system32\spider.exe
2006-11-14 21:38 534,016 –a—— C:\WINNT\system32\spider.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\packager.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\packager.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\odbcconf.exe
2006-11-14 21:38 53,248 –a—— C:\WINNT\system32\odbcconf.exe
2006-11-14 21:38 52,224 –a—— C:\WINNT\system32\secur32.dll
2006-11-14 21:38 52,224 –a—— C:\WINNT\system32\secur32.dll
2006-11-14 21:38 511,488 –a—— C:\WINNT\system32\qedit.dll
2006-11-14 21:38 511,488 –a—— C:\WINNT\system32\qedit.dll
2006-11-14 21:38 51,200 –a—— C:\WINNT\system32\wmerrenu.dll
2006-11-14 21:38 51,200 –a—— C:\WINNT\system32\wmerrenu.dll
2006-11-14 21:38 5,504 ——— C:\WINNT\system32\drivers\smbali.sys
2006-11-14 21:38 5,504 ——— C:\WINNT\system32\drivers\smbali.sys
2006-11-14 21:38 48,640 –a—— C:\WINNT\system32\vdmredir.dll
2006-11-14 21:38 48,640 –a—— C:\WINNT\system32\vdmredir.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\winsta.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\winsta.dll
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\reg.exe
2006-11-14 21:38 48,128 –a—— C:\WINNT\system32\reg.exe
2006-11-14 21:38 479,261 –a—— C:\WINNT\system32\vbscript.dll
2006-11-14 21:38 479,261 –a—— C:\WINNT\system32\vbscript.dll
2006-11-14 21:38 47,616 –a—— C:\WINNT\system32\utilman.exe
2006-11-14 21:38 47,616 –a—— C:\WINNT\system32\utilman.exe
2006-11-14 21:38 446,464 –a—— C:\WINNT\system32\wmvdmoe.dll
2006-11-14 21:38 446,464 –a—— C:\WINNT\system32\wmvdmoe.dll
2006-11-14 21:38 442,398 –a—— C:\WINNT\system32\wmadmoe.dll
2006-11-14 21:38 442,398 –a—— C:\WINNT\system32\wmadmoe.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\regapi.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\regapi.dll
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\rdpclip.exe
2006-11-14 21:38 44,032 –a—— C:\WINNT\system32\rdpclip.exe
2006-11-14 21:38 43,008 –a—— C:\WINNT\system32\ssdpsrv.dll
2006-11-14 21:38 43,008 –a—— C:\WINNT\system32\ssdpsrv.dll
2006-11-14 21:38 423,424 –a—— C:\WINNT\system32\riched20.dll
2006-11-14 21:38 423,424 –a—— C:\WINNT\system32\riched20.dll
2006-11-14 21:38 420,864 –a—— C:\WINNT\system32\shimgvw.dll
2006-11-14 21:38 420,864 –a—— C:\WINNT\system32\shimgvw.dll
2006-11-14 21:38 409,088 –a—— C:\WINNT\system32\vssapi.dll
2006-11-14 21:38 409,088 –a—— C:\WINNT\system32\vssapi.dll
2006-11-14 21:38 40,960 –a—— C:\WINNT\system32\tscupgrd.exe
2006-11-14 21:38 40,960 –a—— C:\WINNT\system32\tscupgrd.exe
2006-11-14 21:38 392,704 –a—— C:\WINNT\system32\ntmssvc.dll
2006-11-14 21:38 392,704 –a—— C:\WINNT\system32\ntmssvc.dll
2006-11-14 21:38 385,024 –a—— C:\WINNT\system32\sqlsrv32.dll
2006-11-14 21:38 385,024 –a—— C:\WINNT\system32\sqlsrv32.dll
2006-11-14 21:38 384,000 –a—— C:\WINNT\system32\themeui.dll
2006-11-14 21:38 384,000 –a—— C:\WINNT\system32\themeui.dll
2006-11-14 21:38 38,912 –a—— C:\WINNT\system32\wsnmp32.dll
2006-11-14 21:38 38,912 –a—— C:\WINNT\system32\wsnmp32.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntmsapi.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntmsapi.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntlanman.dll
2006-11-14 21:38 38,400 –a—— C:\WINNT\system32\ntlanman.dll
2006-11-14 21:38 364,544 –a—— C:\WINNT\system32\ssflwbox.scr
2006-11-14 21:38 364,544 –a—— C:\WINNT\system32\ssflwbox.scr
2006-11-14 21:38 36,352 –a—— C:\WINNT\system32\sens.dll
2006-11-14 21:38 36,352 –a—— C:\WINNT\system32\sens.dll
2006-11-14 21:38 357,376 –a—— C:\WINNT\system32\qdvd.dll
2006-11-14 21:38 357,376 –a—— C:\WINNT\system32\qdvd.dll
2006-11-14 21:38 34,304 –a—— C:\WINNT\system32\rcimlby.exe
2006-11-14 21:38 34,304 –a—— C:\WINNT\system32\rcimlby.exe
2006-11-14 21:38 339,456 –a—— C:\WINNT\system32\usp10.dll
2006-11-14 21:38 339,456 –a—— C:\WINNT\system32\usp10.dll
2006-11-14 21:38 334,848 –a—— C:\WINNT\system32\smlogcfg.dll
2006-11-14 21:38 334,848 –a—— C:\WINNT\system32\smlogcfg.dll
2006-11-14 21:38 33,280 –a—— C:\WINNT\system32\shmgrate.exe
2006-11-14 21:38 33,280 –a—— C:\WINNT\system32\shmgrate.exe
2006-11-14 21:38 32,768 –a—— C:\WINNT\system32\odbcad32.exe
2006-11-14 21:38 32,768 –a—— C:\WINNT\system32\odbcad32.exe
2006-11-14 21:38 32,256 –a—— C:\WINNT\system32\umandlg.dll
2006-11-14 21:38 32,256 –a—— C:\WINNT\system32\umandlg.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\zipfldr.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\zipfldr.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\wiaservc.dll
2006-11-14 21:38 316,416 –a—— C:\WINNT\system32\wiaservc.dll
2006-11-14 21:38 311,327 –a—— C:\WINNT\system32\wmv8dmod.dll
2006-11-14 21:38 311,327 –a—— C:\WINNT\system32\wmv8dmod.dll
2006-11-14 21:38 31,744 –a—— C:\WINNT\system32\pid.dll
2006-11-14 21:38 31,744 –a—— C:\WINNT\system32\pid.dll
2006-11-14 21:38 3,494,303 ——— C:\WINNT\system32\nv4_disp.dll
2006-11-14 21:38 3,494,303 ——— C:\WINNT\system32\nv4_disp.dll
2006-11-14 21:38 3,338 –a—— C:\WINNT\system32\redir.exe
2006-11-14 21:38 3,338 –a—— C:\WINNT\system32\redir.exe
2006-11-14 21:38 297,984 –a—— C:\WINNT\system32\scesrv.dll
2006-11-14 21:38 297,984 –a—— C:\WINNT\system32\scesrv.dll
2006-11-14 21:38 296,448 –a—— C:\WINNT\system32\wmstream.dll
2006-11-14 21:38 296,448 –a—— C:\WINNT\system32\wmstream.dll
2006-11-14 21:38 294,912 –a—— C:\WINNT\system32\wmvdmod.dll
2006-11-14 21:38 294,912 –a—— C:\WINNT\system32\wmvdmod.dll
2006-11-14 21:38 274,432 –a—— C:\WINNT\system32\wmasf.dll
2006-11-14 21:38 274,432 –a—— C:\WINNT\system32\wmasf.dll
2006-11-14 21:38 27,136 –a—— C:\WINNT\system32\ssdpapi.dll
2006-11-14 21:38 27,136 –a—— C:\WINNT\system32\ssdpapi.dll
2006-11-14 21:38 266,752 –a—— C:\WINNT\winhlp32.exe
2006-11-14 21:38 266,752 –a—— C:\WINNT\winhlp32.exe
2006-11-14 21:38 264,704 –a—— C:\WINNT\system32\wzcsvc.dll
2006-11-14 21:38 264,704 –a—— C:\WINNT\system32\wzcsvc.dll
2006-11-14 21:38 258,048 –a—— C:\WINNT\system32\webcheck.dll
2006-11-14 21:38 258,048 –a—— C:\WINNT\system32\webcheck.dll
2006-11-14 21:38 254,976 –a—— C:\WINNT\system32\pdh.dll
2006-11-14 21:38 254,976 –a—— C:\WINNT\system32\pdh.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmpcd.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmpcd.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmnetmgr.dll
2006-11-14 21:38 253,952 –a—— C:\WINNT\system32\wmnetmgr.dll
2006-11-14 21:38 251,904 –a—— C:\WINNT\system32\strmdll.dll
2006-11-14 21:38 251,904 –a—— C:\WINNT\system32\strmdll.dll
2006-11-14 21:38 247,808 –a—— C:\WINNT\system32\wow32.dll
2006-11-14 21:38 247,808 –a—— C:\WINNT\system32\wow32.dll
2006-11-14 21:38 24,576 –a—— C:\WINNT\system32\odbcbcp.dll
2006-11-14 21:38 24,576 –a—— C:\WINNT\system32\odbcbcp.dll
2006-11-14 21:38 24,064 –a—— C:\WINNT\system32\skeys.exe
2006-11-14 21:38 24,064 –a—— C:\WINNT\system32\skeys.exe
2006-11-14 21:38 231,424 –a—— C:\WINNT\system32\upnpui.dll
2006-11-14 21:38 231,424 –a—— C:\WINNT\system32\upnpui.dll
2006-11-14 21:38 23,552 –a—— C:\WINNT\system32\wzcsapi.dll
2006-11-14 21:38 23,552 –a—— C:\WINNT\system32\wzcsapi.dll
2006-11-14 21:38 226,816 –a—— C:\WINNT\system32\srrstr.dll
2006-11-14 21:38 226,816 –a—— C:\WINNT\system32\srrstr.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\slayerxp.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\slayerxp.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\shfolder.dll
2006-11-14 21:38 22,528 –a—— C:\WINNT\system32\shfolder.dll
2006-11-14 21:38 22,016 –a—— C:\WINNT\system32\udhisapi.dll
2006-11-14 21:38 22,016 –a—— C:\WINNT\system32\udhisapi.dll
2006-11-14 21:38 212,480 –a—— C:\WINNT\system32\osk.exe
2006-11-14 21:38 212,480 –a—— C:\WINNT\system32\osk.exe
2006-11-14 21:38 203,264 –a—— C:\WINNT\system32\uxtheme.dll
2006-11-14 21:38 203,264 –a—— C:\WINNT\system32\uxtheme.dll
2006-11-14 21:38 200,704 –a—— C:\WINNT\system32\odbc32.dll
2006-11-14 21:38 200,704 –a—— C:\WINNT\system32\odbc32.dll
2006-11-14 21:38 200,192 –a—— C:\WINNT\system32\termsrv.dll
2006-11-14 21:38 200,192 –a—— C:\WINNT\system32\termsrv.dll
2006-11-14 21:38 193,536 –a—— C:\WINNT\system32\rasppp.dll
2006-11-14 21:38 193,536 –a—— C:\WINNT\system32\rasppp.dll
2006-11-14 21:38 19,456 –a—— C:\WINNT\system32\ssmarque.scr
2006-11-14 21:38 19,456 –a—— C:\WINNT\system32\ssmarque.scr
2006-11-14 21:38 184,832 –a—— C:\WINNT\system32\qcap.dll
2006-11-14 21:38 184,832 –a—— C:\WINNT\system32\qcap.dll
2006-11-14 21:38 184,320 –a—— C:\WINNT\system32\wmadmod.dll
2006-11-14 21:38 184,320 –a—— C:\WINNT\system32\wmadmod.dll
2006-11-14 21:38 18,944 –a—— C:\WINNT\system32\ssbezier.scr
2006-11-14 21:38 18,944 –a—— C:\WINNT\system32\ssbezier.scr
2006-11-14 21:38 174,592 –a—— C:\WINNT\system32\scecli.dll
2006-11-14 21:38 174,592 –a—— C:\WINNT\system32\scecli.dll
2006-11-14 21:38 172,664 –a—— C:\WINNT\system32\xenroll.dll
2006-11-14 21:38 172,664 –a—— C:\WINNT\system32\xenroll.dll
2006-11-14 21:38 171,520 –a—— C:\WINNT\system32\winmm.dll
2006-11-14 21:38 171,520 –a—— C:\WINNT\system32\winmm.dll
2006-11-14 21:38 171,008 –a—— C:\WINNT\system32\sccsccp.dll
2006-11-14 21:38 171,008 –a—— C:\WINNT\system32\sccsccp.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\wtsapi32.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\wtsapi32.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\ssmyst.scr
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\ssmyst.scr
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\psapi.dll
2006-11-14 21:38 17,408 –a—— C:\WINNT\system32\psapi.dll
2006-11-14 21:38 169,984 –a—— C:\WINNT\system32\sccbase.dll
2006-11-14 21:38 169,984 –a—— C:\WINNT\system32\sccbase.dll
2006-11-14 21:38 168,448 –a—— C:\WINNT\system32\wldap32.dll
2006-11-14 21:38 168,448 –a—— C:\WINNT\system32\wldap32.dll
2006-11-14 21:38 165,888 –a—— C:\WINNT\system32\ntmsdba.dll
2006-11-14 21:38 165,888 –a—— C:\WINNT\system32\ntmsdba.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\w32time.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\w32time.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\tapi32.dll
2006-11-14 21:38 165,376 –a—— C:\WINNT\system32\tapi32.dll
2006-11-14 21:38 164,864 –a—— C:\WINNT\system32\upnphost.dll
2006-11-14 21:38 164,864 –a—— C:\WINNT\system32\upnphost.dll
2006-11-14 21:38 16,896 –a—— C:\WINNT\system32\snmpapi.dll
2006-11-14 21:38 16,896 –a—— C:\WINNT\system32\snmpapi.dll
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\watchdog.sys
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\watchdog.sys
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ups.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ups.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ping.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\ping.exe
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\odbc32gt.dll
2006-11-14 21:38 16,384 –a—— C:\WINNT\system32\odbc32gt.dll
2006-11-14 21:38 159,232 –a—— C:\WINNT\system32\schedsvc.dll
2006-11-14 21:38 159,232 –a—— C:\WINNT\system32\schedsvc.dll
2006-11-14 21:38 158,720 –a—— C:\WINNT\system32\srsvc.dll
2006-11-14 21:38 158,720 –a—— C:\WINNT\system32\srsvc.dll
2006-11-14 21:38 147,456 –a—— C:\WINNT\system32\odbctrac.dll
2006-11-14 21:38 147,456 –a—— C:\WINNT\system32\odbctrac.dll
2006-11-14 21:38 14,848 –a—— C:\WINNT\system32\rdpsnd.dll
2006-11-14 21:38 14,848 –a—— C:\WINNT\system32\rdpsnd.dll
2006-11-14 21:38 137,216 –a—— C:\WINNT\system32\ntshrui.dll
2006-11-14 21:38 137,216 –a—— C:\WINNT\system32\ntshrui.dll
2006-11-14 21:38 135,680 –a—— C:\WINNT\system32\rdchost.dll
2006-11-14 21:38 135,680 –a—— C:\WINNT\system32\rdchost.dll
2006-11-14 21:38 134,144 –a—— C:\WINNT\regedit.exe
2006-11-14 21:38 134,144 –a—— C:\WINNT\regedit.exe
2006-11-14 21:38 133,632 –a—— C:\WINNT\system32\rsaenh.dll
2006-11-14 21:38 133,632 –a—— C:\WINNT\system32\rsaenh.dll
2006-11-14 21:38 133,120 –a—— C:\WINNT\system32\sfc_os.dll
2006-11-14 21:38 133,120 –a—— C:\WINNT\system32\sfc_os.dll
2006-11-14 21:38 130,560 –a—— C:\WINNT\system32\sti_ci.dll
2006-11-14 21:38 130,560 –a—— C:\WINNT\system32\sti_ci.dll
2006-11-14 21:38 13,824 –a—— C:\WINNT\system32\rassapi.dll
2006-11-14 21:38 13,824 –a—— C:\WINNT\system32\rassapi.dll
2006-11-14 21:38 13,312 –a—— C:\WINNT\system32\ssstars.scr
2006-11-14 21:38 13,312 –a—— C:\WINNT\system32\ssstars.scr
2006-11-14 21:38 128,512 –a—— C:\WINNT\system32\taskmgr.exe
2006-11-14 21:38 128,512 –a—— C:\WINNT\system32\taskmgr.exe
2006-11-14 21:38 124,928 –a—— C:\WINNT\system32\webvw.dll
2006-11-14 21:38 124,928 –a—— C:\WINNT\system32\webvw.dll
2006-11-14 21:38 122,880 –a—— C:\WINNT\system32\odbcconf.dll
2006-11-14 21:38 122,880 –a—— C:\WINNT\system32\odbcconf.dll
2006-11-14 21:38 120,320 –a—— C:\WINNT\system32\upnp.dll
2006-11-14 21:38 120,320 –a—— C:\WINNT\system32\upnp.dll
2006-11-14 21:38 12,800 –a—— C:\WINNT\system32\runonce.exe
2006-11-14 21:38 12,800 –a—— C:\WINNT\system32\runonce.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\rdsaddin.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\rdsaddin.exe
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\odbcp32r.dll
2006-11-14 21:38 12,288 –a—— C:\WINNT\system32\odbcp32r.dll
2006-11-14 21:38 119,808 –a—— C:\WINNT\system32\wiadss.dll
2006-11-14 21:38 119,808 –a—— C:\WINNT\system32\wiadss.dll
2006-11-14 21:38 118,784 –a—— C:\WINNT\system32\wmsdmoe.dll
2006-11-14 21:38 118,784 –a—— C:\WINNT\system32\wmsdmoe.dll
2006-11-14 21:38 117,760 –a—— C:\WINNT\system32\stobject.dll
2006-11-14 21:38 117,760 –a—— C:\WINNT\system32\stobject.dll
2006-11-14 21:38 112,128 –a—— C:\WINNT\system32\ntmarta.dll
2006-11-14 21:38 112,128 –a—— C:\WINNT\system32\ntmarta.dll
2006-11-14 21:38 110,592 –a—— C:\WINNT\system32\wmsdmod.dll
2006-11-14 21:38 110,592 –a—— C:\WINNT\system32\wmsdmod.dll
2006-11-14 21:38 11,776 –a—— C:\WINNT\system32\sigtab.dll
2006-11-14 21:38 11,776 –a—— C:\WINNT\system32\sigtab.dll
2006-11-14 21:38 109,568 –a—— C:\WINNT\system32\offfilt.dll
2006-11-14 21:38 109,568 –a—— C:\WINNT\system32\offfilt.dll
2006-11-14 21:38 106,496 –a—— C:\WINNT\system32\url.dll
2006-11-14 21:38 106,496 –a—— C:\WINNT\system32\url.dll
2006-11-14 21:38 10,752 –a—— C:\WINNT\system32\tracert.exe
2006-11-14 21:38 10,752 –a—— C:\WINNT\system32\tracert.exe
2006-11-14 21:38 10,752 –a—— C:\WINNT\hh.exe
2006-11-14 21:38 10,752 –a—— C:\WINNT\hh.exe
2006-11-14 21:38 1,998,848 –a—— C:\WINNT\system32\wmploc.dll
2006-11-14 21:38 1,998,848 –a—— C:\WINNT\system32\wmploc.dll
2006-11-14 21:38 1,350,144 –a—— C:\WINNT\system32\query.dll
2006-11-14 21:38 1,350,144 –a—— C:\WINNT\system32\query.dll
2006-11-14 21:38 1,298,432 –a—— C:\WINNT\system32\wmpcore.dll
2006-11-14 21:38 1,298,432 –a—— C:\WINNT\system32\wmpcore.dll
2006-11-14 21:38 1,220,608 –a—— C:\WINNT\system32\wmvcore.dll
2006-11-14 21:38 1,220,608 –a—— C:\WINNT\system32\wmvcore.dll
2006-11-14 21:38 1,157,632 –a—— C:\WINNT\system32\sfcfiles.dll
2006-11-14 21:38 1,157,632 –a—— C:\WINNT\system32\sfcfiles.dll
2006-11-14 21:37 95,744 –a—— C:\WINNT\system32\nlhtml.dll
2006-11-14 21:37 95,744 –a—— C:\WINNT\system32\nlhtml.dll
2006-11-14 21:37 921,475 ——— C:\WINNT\system32\ati3d2ag.dll
2006-11-14 21:37 921,475 ——— C:\WINNT\system32\ati3d2ag.dll
2006-11-14 21:37 91,136 –a—— C:\WINNT\system32\MSOERT2.DLL
2006-11-14 21:37 91,136 –a—— C:\WINNT\system32\MSOERT2.DLL
2006-11-14 21:37 9,728 –a—— C:\WINNT\system32\mstinit.exe
2006-11-14 21:37 9,728 –a—— C:\WINNT\system32\mstinit.exe
2006-11-14 21:37 857,600 –a—— C:\WINNT\system32\netplwiz.dll
2006-11-14 21:37 857,600 –a—— C:\WINNT\system32\netplwiz.dll
2006-11-14 21:37 844,675 ——— C:\WINNT\system32\ati3d1ag.dll
2006-11-14 21:37 844,675 ——— C:\WINNT\system32\ati3d1ag.dll
2006-11-14 21:37 699,392 –a—— C:\WINNT\system32\msxml2.dll
2006-11-14 21:37 699,392 –a—— C:\WINNT\system32\msxml2.dll
2006-11-14 21:37 68,608 –a—— C:\WINNT\system32\mscms.dll
2006-11-14 21:37 68,608 –a—— C:\WINNT\system32\mscms.dll
2006-11-14 21:37 67,584 –a—— C:\WINNT\system32\msctfp.dll
2006-11-14 21:37 67,584 –a—— C:\WINNT\system32\msctfp.dll
2006-11-14 21:37 65,536 –a—— C:\WINNT\system32\msconf.dll
2006-11-14 21:37 65,536 –a—— C:\WINNT\system32\msconf.dll
2006-11-14 21:37 63,663 –a—— C:\WINNT\system32\drivers\atinrvxx.sys
2006-11-14 21:37 63,663 –a—— C:\WINNT\system32\drivers\atinrvxx.sys
2006-11-14 21:37 6,912 ——— C:\WINNT\system32\drivers\hidir.sys
2006-11-14 21:37 6,912 ——— C:\WINNT\system32\drivers\hidir.sys
2006-11-14 21:37 6,656 –a—— C:\WINNT\system32\laprxy.dll
2006-11-14 21:37 6,656 –a—— C:\WINNT\system32\laprxy.dll
2006-11-14 21:37 598,016 –a—— C:\WINNT\system32\mstscax.dll
2006-11-14 21:37 598,016 –a—— C:\WINNT\system32\mstscax.dll
2006-11-14 21:37 584,192 –a—— C:\WINNT\system32\netcfgx.dll
2006-11-14 21:37 584,192 –a—— C:\WINNT\system32\netcfgx.dll
2006-11-14 21:37 57,856 –a—— C:\WINNT\system32\licwmi.dll
2006-11-14 21:37 57,856 –a—— C:\WINNT\system32\licwmi.dll
2006-11-14 21:37 56,591 –a—— C:\WINNT\system32\drivers\atinbtxx.sys
2006-11-14 21:37 56,591 –a—— C:\WINNT\system32\drivers\atinbtxx.sys
2006-11-14 21:37 56,320 –a—— C:\WINNT\system32\mshtmler.dll
2006-11-14 21:37 56,320 –a—— C:\WINNT\system32\mshtmler.dll
2006-11-14 21:37 552,991 –a—— C:\WINNT\system32\msrepl40.dll
2006-11-14 21:37 552,991 –a—— C:\WINNT\system32\msrepl40.dll
2006-11-14 21:37 512,031 –a—— C:\WINNT\system32\msexch40.dll
2006-11-14 21:37 512,031 –a—— C:\WINNT\system32\msexch40.dll
2006-11-14 21:37 504,832 ——— C:\WINNT\system32\msftedit.dll
2006-11-14 21:37 504,832 ——— C:\WINNT\system32\msftedit.dll
2006-11-14 21:37 504,320 –a—— C:\WINNT\system32\logonui.exe
2006-11-14 21:37 504,320 –a—— C:\WINNT\system32\logonui.exe
2006-11-14 21:37 5,120 ——— C:\WINNT\system32\hccoin.dll
2006-11-14 21:37 5,120 ——— C:\WINNT\system32\hccoin.dll
2006-11-14 21:37 49,152 –a—— C:\WINNT\system32\npptools.dll
2006-11-14 21:37 49,152 –a—— C:\WINNT\system32\npptools.dll
2006-11-14 21:37 450,176 ——— C:\WINNT\system32\drivers\ati2mtag.sys
2006-11-14 21:37 450,176 ——— C:\WINNT\system32\drivers\ati2mtag.sys
2006-11-14 21:37 421,919 –a—— C:\WINNT\system32\msrd2x40.dll
2006-11-14 21:37 421,919 –a—— C:\WINNT\system32\msrd2x40.dll
2006-11-14 21:37 42,496 –a—— C:\WINNT\system32\ncobjapi.dll
2006-11-14 21:37 42,496 –a—— C:\WINNT\system32\ncobjapi.dll
2006-11-14 21:37 403,456 ——— C:\WINNT\system32\winbrand.dll
2006-11-14 21:37 403,456 ——— C:\WINNT\system32\winbrand.dll
2006-11-14 21:37 401,462 –a—— C:\WINNT\system32\msvcp60.dll
2006-11-14 21:37 401,462 –a—— C:\WINNT\system32\msvcp60.dll
2006-11-14 21:37 4,608 –a—— C:\WINNT\system32\msimg32.dll
2006-11-14 21:37 4,608 –a—— C:\WINNT\system32\msimg32.dll
2006-11-14 21:37 4,126 –a—— C:\WINNT\system32\msdxmlc.dll
2006-11-14 21:37 4,126 –a—— C:\WINNT\system32\msdxmlc.dll
2006-11-14 21:37 399,360 –a—— C:\WINNT\system32\netlogon.dll
2006-11-14 21:37 399,360 –a—— C:\WINNT\system32\netlogon.dll
2006-11-14 21:37 39,424 –a—— C:\WINNT\system32\net.exe
2006-11-14 21:37 39,424 –a—— C:\WINNT\system32\net.exe
2006-11-14 21:37 388,608 –a—— C:\WINNT\system32\mstsc.exe
2006-11-14 21:37 388,608 –a—— C:\WINNT\system32\mstsc.exe
2006-11-14 21:37 381,440 –a—— C:\WINNT\system32\lmrt.dll
2006-11-14 21:37 381,440 –a—— C:\WINNT\system32\lmrt.dll
2006-11-14 21:37 377,984 –a—— C:\WINNT\system32\ati2dvaa.dll
2006-11-14 21:37 377,984 –a—— C:\WINNT\system32\ati2dvaa.dll
2006-11-14 21:37 368,710 –a—— C:\WINNT\system32\msisam11.dll
2006-11-14 21:37 368,710 –a—— C:\WINNT\system32\msisam11.dll
2006-11-14 21:37 36,463 –a—— C:\WINNT\system32\drivers\atintuxx.sys
2006-11-14 21:37 36,463 –a—— C:\WINNT\system32\drivers\atintuxx.sys
2006-11-14 21:37 348,195 –a—— C:\WINNT\system32\msjetoledb40.dll
2006-11-14 21:37 348,195 –a—— C:\WINNT\system32\msjetoledb40.dll
2006-11-14 21:37 348,191 –a—— C:\WINNT\system32\mspbde40.dll
2006-11-14 21:37 348,191 –a—— C:\WINNT\system32\mspbde40.dll
2006-11-14 21:37 344,095 –a—— C:\WINNT\system32\msxbde40.dll
2006-11-14 21:37 344,095 –a—— C:\WINNT\system32\msxbde40.dll
2006-11-14 21:37 34,735 –a—— C:\WINNT\system32\drivers\atinxsxx.sys
2006-11-14 21:37 34,735 –a—— C:\WINNT\system32\drivers\atinxsxx.sys
2006-11-14 21:37 339,968 –a—— C:\WINNT\system32\mspaint.exe
2006-11-14 21:37 339,968 –a—— C:\WINNT\system32\mspaint.exe
2006-11-14 21:37 33,808 –a—— C:\WINNT\system32\ntio.sys
2006-11-14 21:37 33,808 –a—— C:\WINNT\system32\ntio.sys
2006-11-14 21:37 327,040 –a—— C:\WINNT\system32\drivers\ati2mtaa.sys
2006-11-14 21:37 327,040 –a—— C:\WINNT\system32\drivers\ati2mtaa.sys
2006-11-14 21:37 326,656 –a—— C:\WINNT\system32\netsetup.exe
2006-11-14 21:37 326,656 –a—— C:\WINNT\system32\netsetup.exe
2006-11-14 21:37 323,072 –a—— C:\WINNT\system32\msvcrt.dll
2006-11-14 21:37 323,072 –a—— C:\WINNT\system32\msvcrt.dll
2006-11-14 21:37 32,256 –a—— C:\WINNT\system32\mnmdd.dll
2006-11-14 21:37 32,256 –a—— C:\WINNT\system32\mnmdd.dll
2006-11-14 21:37 319,760 –a—— C:\WINNT\system32\msnsspc.dll
2006-11-14 21:37 319,760 –a—— C:\WINNT\system32\msnsspc.dll
2006-11-14 21:37 319,519 –a—— C:\WINNT\system32\msexcl40.dll
2006-11-14 21:37 319,519 –a—— C:\WINNT\system32\msexcl40.dll
2006-11-14 21:37 30,671 –a—— C:\WINNT\system32\drivers\atinraxx.sys
2006-11-14 21:37 30,671 –a—— C:\WINNT\system32\drivers\atinraxx.sys
2006-11-14 21:37 3,584 ——— C:\WINNT\system32\dsprpres.dll
2006-11-14 21:37 3,584 ——— C:\WINNT\system32\dsprpres.dll
2006-11-14 21:37 29,455 –a—— C:\WINNT\system32\drivers\atinxbxx.sys
2006-11-14 21:37 29,455 –a—— C:\WINNT\system32\drivers\atinxbxx.sys
2006-11-14 21:37 266,752 –a—— C:\WINNT\system32\msctf.dll
2006-11-14 21:37 266,752 –a—— C:\WINNT\system32\msctf.dll
2006-11-14 21:37 26,367 –a—— C:\WINNT\system32\drivers\atinsnxx.sys
2006-11-14 21:37 26,367 –a—— C:\WINNT\system32\drivers\atinsnxx.sys
2006-11-14 21:37 253,983 –a—— C:\WINNT\system32\mstext40.dll
2006-11-14 21:37 253,983 –a—— C:\WINNT\system32\mstext40.dll
2006-11-14 21:37 250,368 –a—— C:\WINNT\system32\mstask.dll
2006-11-14 21:37 250,368 –a—— C:\WINNT\system32\mstask.dll
2006-11-14 21:37 241,725 –a—— C:\WINNT\system32\msuni11.dll
2006-11-14 21:37 241,725 –a—— C:\WINNT\system32\msuni11.dll
2006-11-14 21:37 241,695 –a—— C:\WINNT\system32\msjtes40.dll
2006-11-14 21:37 241,695 –a—— C:\WINNT\system32\msjtes40.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\nmmkcert.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\nmmkcert.dll
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\logagent.exe
2006-11-14 21:37 24,576 –a—— C:\WINNT\system32\logagent.exe
2006-11-14 21:37 238,080 –a—— C:\WINNT\system32\newdev.dll
2006-11-14 21:37 238,080 –a—— C:\WINNT\system32\newdev.dll
2006-11-14 21:37 233,472 –a—— C:\WINNT\system32\mpg4dmod.dll
2006-11-14 21:37 233,472 –a—— C:\WINNT\system32\mpg4dmod.dll
2006-11-14 21:37 230,400 –a—— C:\WINNT\system32\msieftp.dll
2006-11-14 21:37 230,400 –a—— C:\WINNT\system32\msieftp.dll
2006-11-14 21:37 229,376 –a—— C:\WINNT\system32\MSOEACCT.DLL
2006-11-14 21:37 229,376 –a—— C:\WINNT\system32\MSOEACCT.DLL
2006-11-14 21:37 22,528 –a—— C:\WINNT\system32\mslbui.dll
2006-11-14 21:37 22,528 –a—— C:\WINNT\system32\mslbui.dll
2006-11-14 21:37 219,648 –a—— C:\WINNT\system32\logon.scr
2006-11-14 21:37 219,648 –a—— C:\WINNT\system32\logon.scr
2006-11-14 21:37 218,112 ——— C:\WINNT\system32\sbe.dll
2006-11-14 21:37 218,112 ——— C:\WINNT\system32\sbe.dll
2006-11-14 21:37 213,023 –a—— C:\WINNT\system32\msltus40.dll
2006-11-14 21:37 213,023 –a—— C:\WINNT\system32\msltus40.dll
2006-11-14 21:37 210,944 –a—— C:\WINNT\system32\moricons.dll
2006-11-14 21:37 210,944 –a—— C:\WINNT\system32\moricons.dll
2006-11-14 21:37 21,343 ——— C:\WINNT\system32\drivers\atinttxx.sys
2006-11-14 21:37 21,343 ——— C:\WINNT\system32\drivers\atinttxx.sys
2006-11-14 21:37 202,496 ——— C:\WINNT\system32\ati2dvag.dll
2006-11-14 21:37 202,496 ——— C:\WINNT\system32\ati2dvag.dll
2006-11-14 21:37 196,096 –a—— C:\WINNT\system32\mobsync.dll
2006-11-14 21:37 196,096 –a—— C:\WINNT\system32\mobsync.dll
2006-11-14 21:37 192,512 –a—— C:\WINNT\system32\mswebdvd.dll
2006-11-14 21:37 192,512 –a—— C:\WINNT\system32\mswebdvd.dll
2006-11-14 21:37 19,456 –a—— C:\WINNT\system32\licmgr10.dll
2006-11-14 21:37 19,456 –a—— C:\WINNT\system32\licmgr10.dll
2006-11-14 21:37 19,328 ——— C:\WINNT\system32\drivers\usbehci.sys
2006-11-14 21:37 19,328 ——— C:\WINNT\system32\drivers\usbehci.sys
2006-11-14 21:37 187,904 ——— C:\WINNT\system32\xpsp1res.dll
2006-11-14 21:37 187,904 ——— C:\WINNT\system32\xpsp1res.dll
2006-11-14 21:37 182,784 –a—— C:\WINNT\system32\msutb.dll
2006-11-14 21:37 182,784 –a—— C:\WINNT\system32\msutb.dll
2006-11-14 21:37 18,944 ——— C:\WINNT\system32\faxpatch.exe
2006-11-14 21:37 18,944 ——— C:\WINNT\system32\faxpatch.exe
2006-11-14 21:37 174,592 –a—— C:\WINNT\system32\msnetobj.dll
2006-11-14 21:37 174,592 –a—— C:\WINNT\system32\msnetobj.dll
2006-11-14 21:37 172,032 ——— C:\WINNT\system32\mssap.dll
2006-11-14 21:37 172,032 ——— C:\WINNT\system32\mssap.dll
2006-11-14 21:37 163,840 –a—— C:\WINNT\system32\mindex.dll
2006-11-14 21:37 163,840 –a—— C:\WINNT\system32\mindex.dll
2006-11-14 21:37 16,384 –a—— C:\WINNT\system32\nddenb32.dll
2006-11-14 21:37 16,384 –a—— C:\WINNT\system32\nddenb32.dll
2006-11-14 21:37 155,648 ——— C:\WINNT\system32\encdec.dll
2006-11-14 21:37 155,648 ——— C:\WINNT\system32\encdec.dll
2006-11-14 21:37 143,872 –a—— C:\WINNT\system32\msimtf.dll
2006-11-14 21:37 143,872 –a—— C:\WINNT\system32\msimtf.dll
2006-11-14 21:37 131,072 –a—— C:\WINNT\system32\msorcl32.dll
2006-11-14 21:37 131,072 –a—— C:\WINNT\system32\msorcl32.dll
2006-11-14 21:37 13,056 ——— C:\WINNT\system32\drivers\wacompen.sys
2006-11-14 21:37 13,056 ——— C:\WINNT\system32\drivers\wacompen.sys
2006-11-14 21:37 126,976 –a—— C:\WINNT\system32\msdart.dll
2006-11-14 21:37 126,976 –a—— C:\WINNT\system32\msdart.dll
2006-11-14 21:37 12,288 –a—— C:\WINNT\system32\mscpx32r.dll
2006-11-14 21:37 12,288 –a—— C:\WINNT\system32\mscpx32r.dll
2006-11-14 21:37 12,288 ——— C:\WINNT\system32\encapi.dll
2006-11-14 21:37 12,288 ——— C:\WINNT\system32\encapi.dll
2006-11-14 21:37 12,047 ——— C:\WINNT\system32\drivers\atinpdxx.sys
2006-11-14 21:37 12,047 ——— C:\WINNT\system32\drivers\atinpdxx.sys
2006-11-14 21:37 116,736 –a—— C:\WINNT\system32\mplay32.exe
2006-11-14 21:37 116,736 –a—— C:\WINNT\system32\mplay32.exe
2006-11-14 21:37 115,200 –a—— C:\WINNT\system32\net1.exe
2006-11-14 21:37 115,200 –a—— C:\WINNT\system32\net1.exe
2006-11-14 21:37 113,664 –a—— C:\WINNT\system32\msvfw32.dll
2006-11-14 21:37 113,664 –a—— C:\WINNT\system32\msvfw32.dll
2006-11-14 21:37 110,080 ——— C:\WINNT\system32\sbeio.dll
2006-11-14 21:37 110,080 ——— C:\WINNT\system32\sbeio.dll
2006-11-14 21:37 11,904 ——— C:\WINNT\system32\drivers\mutohpen.sys
2006-11-14 21:37 11,904 ——— C:\WINNT\system32\drivers\mutohpen.sys
2006-11-14 21:37 11,615 –a—— C:\WINNT\system32\drivers\atinmdxx.sys
2006-11-14 21:37 11,615 –a—— C:\WINNT\system32\drivers\atinmdxx.sys
2006-11-14 21:37 105,984 –a—— C:\WINNT\system32\netdde.exe
2006-11-14 21:37 105,984 –a—— C:\WINNT\system32\netdde.exe
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\msrle32.dll
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\msrle32.dll
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\localui.dll
2006-11-14 21:37 10,240 –a—— C:\WINNT\system32\localui.dll
2006-11-14 21:37 1,677,312 ——— C:\WINNT\system32\wmvcore2.dll
2006-11-14 21:37 1,677,312 ——— C:\WINNT\system32\wmvcore2.dll
2006-11-14 21:37 1,622,528 –a—— C:\WINNT\system32\netshell.dll
2006-11-14 21:37 1,622,528 –a—— C:\WINNT\system32\netshell.dll
2006-11-14 21:37 1,503,262 –a—— C:\WINNT\system32\msjet40.dll
2006-11-14 21:37 1,503,262 –a—— C:\WINNT\system32\msjet40.dll
2006-11-14 21:37 1,220,608 –a—— C:\WINNT\system32\msvidctl.dll
2006-11-14 21:37 1,220,608 –a—— C:\WINNT\system32\msvidctl.dll
2006-11-14 21:37 1,128,960 –a—— C:\WINNT\system32\mmcndmgr.dll
2006-11-14 21:37 1,128,960 –a—— C:\WINNT\system32\mmcndmgr.dll
2006-11-14 21:36 98,816 –a—— C:\WINNT\system32\clipbrd.exe
2006-11-14 21:36 98,816 –a—— C:\WINNT\system32\clipbrd.exe
2006-11-14 21:36 94,720 –a—— C:\WINNT\system32\dmusic.dll
2006-11-14 21:36 94,720 –a—— C:\WINNT\system32\dmusic.dll
2006-11-14 21:36 91,648 –a—— C:\WINNT\system32\iuctl.dll
2006-11-14 21:36 91,648 –a—— C:\WINNT\system32\iuctl.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\icaapi.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\icaapi.dll
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\dumprep.exe
2006-11-14 21:36 9,216 –a—— C:\WINNT\system32\dumprep.exe
2006-11-14 21:36 88,576 –a—— C:\WINNT\system32\mqsec.dll
2006-11-14 21:36 88,576 –a—— C:\WINNT\system32\mqsec.dll
2006-11-14 21:36 802,304 –a—— C:\WINNT\system32\dxmrtp.dll
2006-11-14 21:36 802,304 –a—— C:\WINNT\system32\dxmrtp.dll
2006-11-14 21:36 8,832 –a—— C:\WINNT\system32\framebuf.dll
2006-11-14 21:36 8,832 –a—— C:\WINNT\system32\framebuf.dll
2006-11-14 21:36 786,432 –a—— C:\WINNT\system32\dxdiag.exe
2006-11-14 21:36 786,432 –a—— C:\WINNT\system32\dxdiag.exe
2006-11-14 21:36 77,312 –a—— C:\WINNT\system32\dmscript.dll
2006-11-14 21:36 77,312 –a—— C:\WINNT\system32\dmscript.dll
2006-11-14 21:36 76,830 –a—— C:\WINNT\system32\drmstor.dll
2006-11-14 21:36 76,830 –a—— C:\WINNT\system32\drmstor.dll
2006-11-14 21:36 76,288 –a—— C:\WINNT\system32\dfrgfat.exe
2006-11-14 21:36 76,288 –a—— C:\WINNT\system32\dfrgfat.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\tlntsess.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\tlntsess.exe
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\ils.dll
2006-11-14 21:36 73,728 –a—— C:\WINNT\system32\ils.dll
2006-11-14 21:36 70,656 –a—— C:\WINNT\system32\defrag.exe
2006-11-14 21:36 70,656 –a—— C:\WINNT\system32\defrag.exe
2006-11-14 21:36 70,144 –a—— C:\WINNT\system32\cryptdlg.dll
2006-11-14 21:36 70,144 –a—— C:\WINNT\system32\cryptdlg.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\tlntsvrp.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\tlntsvrp.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\fxsperf.dll
2006-11-14 21:36 7,168 –a—— C:\WINNT\system32\fxsperf.dll
2006-11-14 21:36 7,040 –a—— C:\WINNT\system32\kd1394.dll
2006-11-14 21:36 7,040 –a—— C:\WINNT\system32\kd1394.dll
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\tlntsvr.exe
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\tlntsvr.exe
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\fdeploy.dll
2006-11-14 21:36 67,584 –a—— C:\WINNT\system32\fdeploy.dll
2006-11-14 21:36 67,456 –a—— C:\WINNT\system32\drivers\mqac.sys
2006-11-14 21:36 67,456 –a—— C:\WINNT\system32\drivers\mqac.sys
2006-11-14 21:36 66,560 –a—— C:\WINNT\system32\faultrep.dll
2006-11-14 21:36 66,560 –a—— C:\WINNT\system32\faultrep.dll
2006-11-14 21:36 61,440 –a—— C:\WINNT\system32\dbnetlib.dll
2006-11-14 21:36 61,440 –a—— C:\WINNT\system32\dbnetlib.dll
2006-11-14 21:36 608,768 –a—— C:\WINNT\system32\mqqm.dll
2006-11-14 21:36 608,768 –a—— C:\WINNT\system32\mqqm.dll
2006-11-14 21:36 602,112 –a—— C:\WINNT\system32\drmv2clt.dll
2006-11-14 21:36 602,112 –a—— C:\WINNT\system32\drmv2clt.dll
2006-11-14 21:36 6,656 –a—— C:\WINNT\system32\fxsres.dll
2006-11-14 21:36 6,656 –a—— C:\WINNT\system32\fxsres.dll
2006-11-14 21:36 596,480 –a—— C:\WINNT\system32\INETCOMM.DLL
2006-11-14 21:36 596,480 –a—— C:\WINNT\system32\INETCOMM.DLL
2006-11-14 21:36 59,392 –a—— C:\WINNT\system32\iesetup.dll
2006-11-14 21:36 59,392 –a—— C:\WINNT\system32\iesetup.dll
2006-11-14 21:36 58,368 –a—— C:\WINNT\system32\dpvsetup.exe
2006-11-14 21:36 58,368 –a—— C:\WINNT\system32\dpvsetup.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\tlntadmn.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\tlntadmn.exe
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\nwwks.dll
2006-11-14 21:36 57,856 –a—— C:\WINNT\system32\nwwks.dll
2006-11-14 21:36 57,344 –a—— C:\WINNT\system32\dmcompos.dll
2006-11-14 21:36 57,344 –a—— C:\WINNT\system32\dmcompos.dll
2006-11-14 21:36 56,320 –a—— C:\WINNT\system32\dpnhupnp.dll
2006-11-14 21:36 56,320 –a—— C:\WINNT\system32\dpnhupnp.dll
2006-11-14 21:36 559,616 –a—— C:\WINNT\system32\fxsst.dll
2006-11-14 21:36 559,616 –a—— C:\WINNT\system32\fxsst.dll
2006-11-14 21:36 55,296 –a—— C:\WINNT\system32\digest.dll
2006-11-14 21:36 55,296 –a—— C:\WINNT\system32\digest.dll
2006-11-14 21:36 545,792 –a—— C:\WINNT\system32\wsecedit.dll
2006-11-14 21:36 545,792 –a—— C:\WINNT\system32\wsecedit.dll
2006-11-14 21:36 54,272 –a—— C:\WINNT\system32\clusapi.dll
2006-11-14 21:36 54,272 –a—— C:\WINNT\system32\clusapi.dll
2006-11-14 21:36 53,248 –a—— C:\WINNT\system32\cryptsvc.dll
2006-11-14 21:36 53,248 –a—— C:\WINNT\system32\cryptsvc.dll
2006-11-14 21:36 51,712 –a—— C:\WINNT\system32\ipconfig.exe
2006-11-14 21:36 51,712 –a—— C:\WINNT\system32\ipconfig.exe
2006-11-14 21:36 498,205 –a—— C:\WINNT\system32\dxmasf.dll
2006-11-14 21:36 498,205 –a—— C:\WINNT\system32\dxmasf.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\ixsso.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\ixsso.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\dpwsockx.dll
2006-11-14 21:36 49,664 –a—— C:\WINNT\system32\dpwsockx.dll
2006-11-14 21:36 49,152 –a—— C:\WINNT\system32\eventlog.dll
2006-11-14 21:36 49,152 –a—— C:\WINNT\system32\eventlog.dll
2006-11-14 21:36 489,984 –a—— C:\WINNT\system32\dbghelp.dll
2006-11-14 21:36 489,984 –a—— C:\WINNT\system32\dbghelp.dll
2006-11-14 21:36 478,720 –a—— C:\WINNT\system32\mqsnap.dll
2006-11-14 21:36 478,720 –a—— C:\WINNT\system32\mqsnap.dll
2006-11-14 21:36 471,040 –a—— C:\WINNT\system32\cryptui.dll
2006-11-14 21:36 471,040 –a—— C:\WINNT\system32\cryptui.dll
2006-11-14 21:36 467,456 –a—— C:\WINNT\system32\mqutil.dll
2006-11-14 21:36 467,456 –a—— C:\WINNT\system32\mqutil.dll
2006-11-14 21:36 45,568 –a—— C:\WINNT\system32\docprop2.dll
2006-11-14 21:36 45,568 –a—— C:\WINNT\system32\docprop2.dll
2006-11-14 21:36 443,392 –a—— C:\WINNT\system32\fxsapi.dll
2006-11-14 21:36 443,392 –a—— C:\WINNT\system32\fxsapi.dll
2006-11-14 21:36 435,200 –a—— C:\WINNT\system32\ipnathlp.dll
2006-11-14 21:36 435,200 –a—— C:\WINNT\system32\ipnathlp.dll
2006-11-14 21:36 42,537 –a—— C:\WINNT\system32\keyboard.sys
2006-11-14 21:36 42,537 –a—— C:\WINNT\system32\keyboard.sys
2006-11-14 21:36 41,472 –a—— C:\WINNT\system32\cmdl32.exe
2006-11-14 21:36 41,472 –a—— C:\WINNT\system32\cmdl32.exe
2006-11-14 21:36 395,264 –a—— C:\WINNT\system32\fxsxp32.dll
2006-11-14 21:36 395,264 –a—— C:\WINNT\system32\fxsxp32.dll
2006-11-14 21:36 391,168 –a—— C:\WINNT\system32\fxstiff.dll
2006-11-14 21:36 391,168 –a—— C:\WINNT\system32\fxstiff.dll
2006-11-14 21:36 380,445 –a—— C:\WINNT\system32\expsrv.dll
2006-11-14 21:36 380,445 –a—— C:\WINNT\system32\expsrv.dll
2006-11-14 21:36 38,912 –a—— C:\WINNT\system32\hhsetup.dll
2006-11-14 21:36 38,912 –a—— C:\WINNT\system32\hhsetup.dll
2006-11-14 21:36 36,922 –a—— C:\WINNT\system32\imeshare.dll
2006-11-14 21:36 36,922 –a—— C:\WINNT\system32\imeshare.dll
2006-11-14 21:36 35,328 –a—— C:\WINNT\system32\dfrgsnap.dll
2006-11-14 21:36 35,328 –a—— C:\WINNT\system32\dfrgsnap.dll
2006-11-14 21:36 324,608 –a—— C:\WINNT\system32\cmdial32.dll
2006-11-14 21:36 324,608 –a—— C:\WINNT\system32\cmdial32.dll
2006-11-14 21:36 318,464 –a—— C:\WINNT\system32\ippromon.dll
2006-11-14 21:36 318,464 –a—— C:\WINNT\system32\ippromon.dll
2006-11-14 21:36 31,744 –a—— C:\WINNT\system32\dmloader.dll
2006-11-14 21:36 31,744 –a—— C:\WINNT\system32\dmloader.dll
2006-11-14 21:36 307,712 –a—— C:\WINNT\system32\cscui.dll
2006-11-14 21:36 307,712 –a—— C:\WINNT\system32\cscui.dll
2006-11-14 21:36 30,208 –a—— C:\WINNT\system32\imgutil.dll
2006-11-14 21:36 30,208 –a—— C:\WINNT\system32\imgutil.dll
2006-11-14 21:36 294,912 –a—— C:\WINNT\system32\iedkcs32.dll
2006-11-14 21:36 294,912 –a—— C:\WINNT\system32\iedkcs32.dll
2006-11-14 21:36 29,696 –a—— C:\WINNT\system32\dpnhpast.dll
2006-11-14 21:36 29,696 –a—— C:\WINNT\system32\dpnhpast.dll
2006-11-14 21:36 29,696 ——— C:\WINNT\system32\asr_pfu.exe
2006-11-14 21:36 29,696 ——— C:\WINNT\system32\asr_pfu.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\ie4uinit.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\ie4uinit.exe
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\dbnmpntw.dll
2006-11-14 21:36 28,672 –a—— C:\WINNT\system32\dbnmpntw.dll
2006-11-14 21:36 28,160 –a—— C:\WINNT\system32\pidgen.dll
2006-11-14 21:36 28,160 –a—— C:\WINNT\system32\pidgen.dll
2006-11-14 21:36 277,504 –a—— C:\WINNT\system32\appmgr.dll
2006-11-14 21:36 277,504 –a—— C:\WINNT\system32\appmgr.dll
2006-11-14 21:36 271,360 –a—— C:\WINNT\system32\fxscomex.dll
2006-11-14 21:36 271,360 –a—— C:\WINNT\system32\fxscomex.dll
2006-11-14 21:36 266,240 –a—— C:\WINNT\system32\drmclien.dll
2006-11-14 21:36 266,240 –a—— C:\WINNT\system32\drmclien.dll
2006-11-14 21:36 263,680 –a—— C:\WINNT\system32\duser.dll
2006-11-14 21:36 263,680 –a—— C:\WINNT\system32\duser.dll
2006-11-14 21:36 263,168 –a—— C:\WINNT\system32\devmgr.dll
2006-11-14 21:36 263,168 –a—— C:\WINNT\system32\devmgr.dll
2006-11-14 21:36 26,112 –a—— C:\WINNT\system32\dmband.dll
2006-11-14 21:36 26,112 –a—— C:\WINNT\system32\dmband.dll
2006-11-14 21:36 253,440 –a—— C:\WINNT\system32\ddraw.dll
2006-11-14 21:36 253,440 –a—— C:\WINNT\system32\ddraw.dll
2006-11-14 21:36 250,368 –a—— C:\WINNT\system32\fxssvc.exe
2006-11-14 21:36 250,368 –a—— C:\WINNT\system32\fxssvc.exe
2006-11-14 21:36 25,600 –a—— C:\WINNT\system32\dfsshlex.dll
2006-11-14 21:36 25,600 –a—— C:\WINNT\system32\dfsshlex.dll
2006-11-14 21:36 249,856 –a—— C:\WINNT\system32\adsiis.dll
2006-11-14 21:36 249,856 –a—— C:\WINNT\system32\adsiis.dll
2006-11-14 21:36 240,640 –a—— C:\WINNT\system32\hnetcfg.dll
2006-11-14 21:36 240,640 –a—— C:\WINNT\system32\hnetcfg.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsvinn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsvinn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsrpcn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\dbmsrpcn.dll
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\conime.exe
2006-11-14 21:36 24,576 –a—— C:\WINNT\system32\conime.exe
2006-11-14 21:36 24,064 –a—— C:\WINNT\system32\fxsdrv.dll
2006-11-14 21:36 24,064 –a—— C:\WINNT\system32\fxsdrv.dll
2006-11-14 21:36 238,592 –a—— C:\WINNT\system32\compatui.dll
2006-11-14 21:36 238,592 –a—— C:\WINNT\system32\compatui.dll
2006-11-14 21:36 237,056 –a—— C:\WINNT\system32\icm32.dll
2006-11-14 21:36 237,056 –a—— C:\WINNT\system32\icm32.dll
2006-11-14 21:36 236,032 –a—— C:\WINNT\system32\fxst30.dll
2006-11-14 21:36 236,032 –a—— C:\WINNT\system32\fxst30.dll
2006-11-14 21:36 231,936 –a—— C:\WINNT\system32\tracerpt.exe
2006-11-14 21:36 231,936 –a—— C:\WINNT\system32\tracerpt.exe
2006-11-14 21:36 227,840 –a—— C:\WINNT\system32\dsquery.dll
2006-11-14 21:36 227,840 –a—— C:\WINNT\system32\dsquery.dll
2006-11-14 21:36 216,064 –a—— C:\WINNT\system32\fxscover.exe
2006-11-14 21:36 216,064 –a—— C:\WINNT\system32\fxscover.exe
2006-11-14 21:36 206,336 –a—— C:\WINNT\system32\dpvoice.dll
2006-11-14 21:36 206,336 –a—— C:\WINNT\system32\dpvoice.dll
2006-11-14 21:36 204,288 –a—— C:\WINNT\system32\ieaksie.dll
2006-11-14 21:36 204,288 –a—— C:\WINNT\system32\ieaksie.dll
2006-11-14 21:36 20,992 –a—— C:\WINNT\system32\fxsext32.dll
2006-11-14 21:36 20,992 –a—— C:\WINNT\system32\fxsext32.dll
2006-11-14 21:36 20,480 –a—— C:\WINNT\system32\dbmsadsn.dll
2006-11-14 21:36 20,480 –a—— C:\WINNT\system32\dbmsadsn.dll
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\fontview.exe
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\fontview.exe
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\ersvc.dll
2006-11-14 21:36 19,456 –a—— C:\WINNT\system32\ersvc.dll
2006-11-14 21:36 185,856 –a—— C:\WINNT\system32\fxswzrd.dll
2006-11-14 21:36 185,856 –a—— C:\WINNT\system32\fxswzrd.dll
2006-11-14 21:36 183,808 –a—— C:\WINNT\system32\gptext.dll
2006-11-14 21:36 183,808 –a—— C:\WINNT\system32\gptext.dll
2006-11-14 21:36 180,224 –a—— C:\WINNT\system32\dwwin.exe
2006-11-14 21:36 180,224 –a—— C:\WINNT\system32\dwwin.exe
2006-11-14 21:36 178,688 –a—— C:\WINNT\system32\eudcedit.exe
2006-11-14 21:36 178,688 –a—— C:\WINNT\system32\eudcedit.exe
2006-11-14 21:36 172,544 –a—— C:\WINNT\system32\dmime.dll
2006-11-14 21:36 172,544 –a—— C:\WINNT\system32\dmime.dll
2006-11-14 21:36 17,792 ——— C:\WINNT\system32\drivers\irbus.sys
2006-11-14 21:36 17,792 ——— C:\WINNT\system32\drivers\irbus.sys
2006-11-14 21:36 168,960 –a—— C:\WINNT\system32\dinput8.dll
2006-11-14 21:36 168,960 –a—— C:\WINNT\system32\dinput8.dll
2006-11-14 21:36 165,888 –a—— C:\WINNT\system32\mqrt.dll
2006-11-14 21:36 165,888 –a—— C:\WINNT\system32\mqrt.dll
2006-11-14 21:36 165,376 –a—— C:\WINNT\system32\els.dll
2006-11-14 21:36 165,376 –a—— C:\WINNT\system32\els.dll
2006-11-14 21:36 164,352 –a—— C:\WINNT\system32\mqtrig.dll
2006-11-14 21:36 164,352 –a—— C:\WINNT\system32\mqtrig.dll
2006-11-14 21:36 16,384 –a—— C:\WINNT\system32\ds32gt.dll
2006-11-14 21:36 16,384 –a—— C:\WINNT\system32\ds32gt.dll
2006-11-14 21:36 158,720 –a—— C:\WINNT\system32\credui.dll
2006-11-14 21:36 158,720 –a—— C:\WINNT\system32\credui.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\dpnet.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\dpnet.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\appmgmts.dll
2006-11-14 21:36 156,672 –a—— C:\WINNT\system32\appmgmts.dll
2006-11-1